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PREFACE 


The motivation to hold a workshop on restructurable controls arose from several 
recent developments associated with automatic flight control systems in aircraft. 

First, modern analysis and synthesis procedures are finding increased acceptance in 
this field, are rapidly maturing, are relatively robust, and are becoming highly 
automated through the use of interactive computer processes. Second, the ability to 
obtain the data necessary for the design of aircraft controls is also being automated. 
Finally, a series of flight tests conducted at NASA Langley Research Center in May 
1981 demonstrated the ability to generate complete designs of various autopilots for 
a specific aircraft on an overnight basis. The flight test results with the newly 
designed autopilots were excellent. 

As an offshoot to these tests, and as a part of an overall program that has 
bedome known as restructurable controls, an experiment was conceived to do a com- 
pletely automated design, within the limits of the procedures, for an assumed unknown 
aircraft and to do it with minimal intervention of designers. The motivation was to 
investigate the possibility of using these techniques to augment on-board capability 
to accommodate unanticipated failures and to assess the possibility of providing 
industry with an end-to-end design package. The elements of the experiment were: 

Identify in flight the aircraft parameters needed for the control system design 
and do this automatically and in real time 

Design in real time the automatic control law using the data obtained above, 
basing the design on pre-established design procedure and design criteria 

Implement and flight test the control law in real time 

Notwithstanding some theoretical pitfalls, such as the facts that parameter 
identification processes do not always converge to the correct set and that much work 
needs to be done to fully automate the control system design process, researchers at 
Langley examined what could be done in this area in general and what had been done 
specifically. We started with a given aircraft and noted that its parameters were 
available from several sources, including both DATCOM and flight data that were 
analyzed using various parameter identification algorithms. Data from these sources 
had been used to design the flight control laws for the aircraft, and they had all 
worked with varying degrees of success in flight tests. Our conclusion was that the 
experiment would redo what had already been done with one significant difference: 
the time scale would be compressed from years to 1 day. A corollary to this con- 
clusion was that it was likely that the same time scale compression in the design 
procedure could be achieved for a given aircraft about which a reasonable amount of 
data was available. In fact, if one were concerned in the design with only one 
flight condition, then the process should take only a few minutes. If this process 
could be further reduced to a few seconds and the design fully automated, then such a 
procedure could provide a backup capability that could potentially be useful in future 
aircraft with flight-crucial controls. The examination of the benefits of such tech- 
niques led to a closer study of the technical implications and provided the basis for 
this workshop. 

The potential applications of these possibilities in the real-life experiences 
cited in the proceedings (the Delta Flight 1080 incident and the American Airlines 
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DC-10 Chicago accident) and the requirements associated with the implementation of 
flight-crucial controls in commercial aircraft of the near future laid the groundwork 
for this workshop. 

W. E. Howell, W. T. Bundick, A. J. Ostroff, 

R. M. Hueschen, and Christine M. Belcastro 
NASA Langley Research Center 
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1.0 INTRODUCTION 


1.1 Background 


In modern aircraft equipped with sophisticated controls there are an 
unlimited number of ways in which things can go wrong. Unfortunately to 
date, there are only a limited number of ways in which some of these things 
can be corrected. Typically, this correctable set contains problems which 
can be anticipated and for which appropriately pre-planned procedures 
and/or actions have been specified, i.e., they are problems for which a set 
of contingency plans to reconfigure the aircraft or its control mode have 
been specified. A typical example is the procedure for handling an engine- 
out condition during takeoff. 

The unanticipated problems or failures are the cause of most incidents 
and/or accidents and present the biggest challenge to the control system 
designer. Often, accident investigations find that there was a way in 
which the aircraft could have been saved if the proper actions had been 
taken in a timely fashion. Because this time frame is typically a few 
seconds and given the level of stress and confusion during these incidents, 
it is understandable that a pilot may not find the solution in time to 
salvage the aircraft. 

Furthermore, pressures to realize economic gains are forcing airframe 
manufacturers to consider aircraft designs with reduced static stability 
(RSS) and associated automatic control systems of increased complexity and 
capabilities. While these fly-by-wire (FBW) control systems will un- 
doubtedly incorporate numerous contingency plans to deal with predictable 
failures, the probability of an unanticipated sequence of events leading 
the pilot into a situation in which the solution is not intuitively clear 
is drastically increased. However, with such highly augmented aircraft and 
with the application of recent theoretical and technological developments, 
it is probable that the aircraft will be flyable in some mode. 

With the emerging theoretical capabilities and the powerful computa- 
tional capability likely to be available on future aircraft, it appears 
that the potential exists to effectively provide the equivalent of several 
months design effort in a few seconds to help mitigate the consequences of 



unanticipated failures in aircraft. Two examples in which aircraft control 
system failures were unanticipated but solvable are included in the 
Appendices. In one case* (Appendix A), the pilot restructured the basic 
longitudinal control law and successfully landed the aircraft; in the other 
case (Appendix B), the pilot was unable to do so. 

While neither the organizers nor the participants of the workshop wish 
to single out these two cases as indicative of shortcomings, either from 
the system or the pilot, they do serve to emphasize the timeliness of the 
problem we wish to address. 

1.2 Framework of Workshop 

On September 21 and 22, 1982, the Applied Control Branch, Flight Con- 
trol Systems Division, Langley Research Center, National Aeronautics and 
Space Administration organized a workshop on Restructurable Control at the 
Langley Research Center, Hampton, Virginia. 

The purpose of this workshop was to elicit ideas which may be applied 
to the real time, automatic, "instantaneous fix" of a wide variety of 
anticipated failures, and, in the not too distant future, to the problem of 
restructuring in real time the control system of an aircraft following 
unanticipated failures. 

A group of experts from academia and industry in the fields of control 
theory, aeromechanics, system identification, and related fields were 
invited to present their perception of the problem and to recommend what 
combination (s) of the emerging methodologies can be applied to the 
solution of the problem or parts thereof. 

1.3 Problem Definition 

The problem can be stated as follows. Upon failure of a control 
element, the control system is to be restructured in such a way that the 
aircraft recovers to a safe condition and can then be flown, either 
manually or automatically, to a safe landing. It is assumed that the 


* The article Flight 1080 which appeared in Airline Pilot (July 1978) 
has been reproduced in Appendix A by permission of the publisher. 
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failure occurs in a control element(s) but that the flight control computer 
and the aircraft sensors are fully operational. 

The process of restructuring the control system includes, as a mini- 
mum, the detection and identification of the failure(s), identification of 
the new plant, redesign of the control laws or gains, and generation of 
information for display to the pilot. Two possible conceptual interactions 
of these elements are presented in Figure 1. 

It should be noted that there is a difference between the concept of 
reconf igurable controls which is currently under study and the concept of 
restructurable controls which is being addressed for the first time at this 
workshop. The principal distinction is the degree of a priori knowledge 
about the causes and effects of failure. Other distinctions are identified 
in Table 1. 


1.4 Organization and Theme of Proceedings 

Included in the following sections of these proceedings are the 
presentations by the invited speakers to the workshop (Section 2.0) and a 
summary of the comments made by the attendees to the workshop during the 
discussion period that followed the presentations (Section 3.0). 

The appendices include the Delta Flight 1080 story (Appendix A) and excerpts 
from the NTSB report on the American Airlines DC-10 crash in Chicago 
(Appendix B). 

The organizers of this workshop hope that other researchers and practi- 
tioners will be motivated by the presentations and discussions in these 
proceedings into exploring and expanding the proposed approaches and into 
formulating alternate approaches to the problem of restructurable controls. 
The results of these efforts will be essential to assure that future air- 
craft will meet or exceed the enviable safety record of today's aircraft. 
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Figure 1. Conceptual Block Diagram of Two Approaches 
to the Restructurable Control Problem. 


Table 1. Differences Between Reconfigurable and Restructurable Controls 


Reconfigurable Controls 

Restructurable Controls 

Loss of given control surfaces 
anticipated a-priori 

Less a priori knowledge assumed 

Redistribution of forces and moments 
attempted from remaining surfaces 
and engines using 
previously stored control law 

May apply to broader spectrum of 
problems (i.e., s/w failures) 

Near term possible 

Long term goal 











2.0 


PRESENTATIONS 




ON RESTRUCTURABLE CONTROL SYSTEM THEORY 


Michael Athans 

Massachusetts Institute of Technology 
Cambridge, MA 02139 


Introductory Remarks 

The main theme of my talk is 
the exposition of the state of sto- 
chastic system and control theory 
as it impacts Restructurable Con- 
trol issues. 

Let me first state the basic 
assumptions that I am going to 
make. Effectively I am not going 
to pay attention at this meeting to 
the problem of sensor failure 
detection, because, I think that 
this problem is well in hand from 
both a theoretical and pragmatic 


point of view. Computer failures 
will also be ignored, since I tend 
to doubt that the pilot can repro- 
gram the flight control computer. 

I will assume that one or more 
aerodynamic or propulsion control 
elements or some part of the struc- 
ture fails or is seriously malfunc- 
tioning. I also assume that the 
sensors that can help and/or the 
computer that can figure out what 
is going on are available. 

The problem as I see it is to 
try to classify the impact of fail- 
ure upon the aircraft motion. 



BASIC PROBLEHS 


• ASSUMPTIONS 

. ONE (OR MORE] AERODYNAMIC OR PROPULSION CONTROL ELEMENT 
FAILS OR IS SERIOUSLY MALFUNCTIONING. 

- SENSORS AND COMPUTERS ARE WORKING. 

• PROBLEMS 

- CLASSIFY THE IMPACT OF FAILURE UPON AIRCRAFT MOTION 

- STATIC CEQUILIBRIUM) 

- DYNAMIC 

- ISOLATE FAILED ELEMENT 

- QUANTIFY FAILURE IMPACT 

- CHANGE CONTROL STRATEGY 

• RAPID FAILURE DETECTION, ISOLATION, IDENTIFICATION, AND QUANTIFICATION 
MAY BE CRITICAL. 


I think there are two very 
distinct and different kinds of 
problems we have to address: 
(1) what is the impact of this con- 
trol element failure upon the 
static or equilibrium flight of the 
airplane, and (2) what may be the 
impact of that failure upon the 
dynamics of the airplane? 

Quite often, of course, there 
will be failures that you cannot 
classify using this very neat dis- 
tinction; but, I think that it is 
important to at least try to put 
the problem in some kind of a box 
so we can talk about it. Obvious- 


ly we should try to isolate the 
failed element and quantify its im- 
pact; then somehow, we have to 
change the control strategy. 
Whether we do that by developing 
proper displays for the pilot or 
whether this is done automatically 
raises another set of very fascin- 
nating issues. 

However, time is critical in 
all of these applications and our 
ability to rapidly identify that a 
failure has occurred, isolate it, 
identify it to the degree possible, 
and, in particular, quantify its 
impact, may be critical. 
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PRESENTATION THEME 


• OVERVIEW AVAILABLE RESULTS IN STOCHASTIC 
CONTROL THEORY THAT ARE RELEVANT TO 
RESTRUCTURABLE CONTROL PROBLEM FOR AIRCRAFT 


Given the names of the people 
that are making presentations, I 
decided to take a particular theme 
for this talk. I will present an 
overview of some available results 
in stochastic control theory be- 
cause that is the discipline that 
this problem falls under. 

First of all we are talking 
about control. The fact that it is 
also stochastic control is obvious 
because we certainly cannot antici- 
pate the failure. I would like to 
stress that most of the results 
that I am going to talk about have 


not yet appeared in the literature; 
some have appeared as Ph.D. theses 
recently completed at MIT. I will 
try to overview them, and include 
some other research that is going 
on at ALPHATECH in order to pull 
this presentation together. 

This will give a bird's eye 
view of what is known from a theo- 
retical point of view, not just an 
overall stochastic control theory 
overview, but theory that I believe 
is really relevant to the problem 
at hand. This is the theme of my 
presentation. 
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CONTROL PROBLEM IS MULTIVARIABLE 


• Lion, DELTA 1080 STORY 

- STUCK ELEVATOR IMPACTED ONLY LONGITUDINAL DYNAMICS 

- ENGINE CONFIGURATION PROVIDED (LIMITED) CONTROL MOMENT 
REDUNDANCY 

- A SET OF STATIC EQUILIBRIUM FLIGHT CONDITIONS: THESE 
ARE CONSTRAINED 

- A SET OF FOUR CONTROL VARIABLES WERE AVAILABLE 

-ENGINE THRUSTS 
- STAfll LI ZER/ ELEVATOR 

• AN INTEGRATED AERODYNAMIC/ PROPULS ION CONTROL SYSTEM MAY HAVE MADE 
PILOTS PROBLEM EASIER. 

• QUESTIONS: 

- what is status of multivariable EQUILIBRIUM THEORY? 

- WHAT IS STATUS OF MULTIVARIABLE DYNAMIC THEORY? 


What I would like to do now, 
given that we are trying to put the 
problem into perspective, is to 
assert certain conclusions by occa- 
sionally referring to the material 
that was provided to us. 

First of all, the control 
problem is a multivariable control 
problem. Suppose we examine the 
Delta flight story after the pilots 
found out that the stuck elevator 
clearly impacted the longitudinal 
10 


dynamics but they did not particu- 
larly have any problems with the 
lateral control system. 

If the engines were not cant- 
ed, as they are on the L-1011, I 
do not know what the pilot could 
have done about it (unless he 
drilled a hole on top of the air- 
plane and put some sort of a flap 
out there). The canted engines 
provided some control moment type 
of a redundancy; effectively, the 




failure of the elevator changed the 
set of the static equilibrium 
flight conditions that were 
possible. 

The L-1011 pilot was particu- 
larly smart to realize that he did 
have a functionally redundant con- 
trol that he would be able to 
operate, not in the most efficient 
manner fuel -wise, but at least to 
stabilize his airplane and to have 
a limp-home capability. 

If you think about it, there 
were really four control variables 
available to the pilot. He had 
three engine thrusts that were cant- 
ed. If he had some additional 
problems with the lateral dynamics, 
he may have been able to apply dif- 
ferential thrust in the two engines 
and still maintain equilibrium 
flight. So, my assertion that all 
of these problems have to be inves- 
tigated in a multivariable context 
is based on these considerations. 


Now, if there was some sort of 
an integrated aerodynamics/propul- 
sion control system, the pilot's 
problems may have been a little 
easier, although that is beside the 
point. 

If you accept my assertion 
that in all these examples we are 
dealing with multivariable control 
problems, we can ask the following 
questions: (1) what do we know 

about multivariable equilibrium 
theory, and (2) what do we know 
about multivariable dynamic theory 
from the point of view of control 
system design and building of 
model s? 

One of the conclusions is that 
we cannot think in terms of single 
input-single output kinds of con- 
trol loops. There are at least two 
inputs and I think, for future air- 
planes, there is no reason why 
there wi 1 1 not be even more 
redundancy. 



FAILURE DETECTION/IDEirnFICATION PROBLEM IS A 
MULTI -HYPOriHESIS TESTING PROBLEM 

• LlOll. DELTA 1080 STORY 

- FLIGHT CREW HAD TO FORMULATE, TEST, AND REJECT SEVERAL 
HYPOTHESES, E.6. 

. STABILIZER SETTING 
. HYDRAULIC CHECKS 

• NO AVAILABLE SENSOR THAT COULD DIRECTLY IDENTIFY STUCK ELEVATOR. 

• LESSONS: 

< FAILURE HYPOTHESES MAY HAVE TO BE ACCEPTED OR REJECTED 
VIA INDIRECT MEASUREMENTS. 

• QUESTIONS: 

- WHAT IS THE STATUS OF HYPOTHESIS TESTING THEORIES? 

- GIVEN COMPUTATIONAL CONSIDERATIONS IN HYPOTHESIS -TESTING 
ALGORITHMS (COMPOUNDED COMBINATORIAL PROBLEMS}, HOW DO 
WE PRUNE THE DEPTH AND BREADTH OF TREE OF HYPOTHESES? 

. ARTIFICIAL INTELLIGENCE? 


The problem of identifying and 
detecting a failure, looking at it 
from a mathematical point of view, 
falls in a time-honored class of 
problems that usually arise in the 
first course of communication 
theory. If you look in Van Trees' 
book you will find out that the 
first technical topic is static hy- 
pothesis testing. Usually this is 


the signal -in-noise detection prob- 
lem. From a system theoretic point 
of view, a failure causes something 
else to happen resulting in a hypo- 
thesis testing problem. It becomes 
a multiple hypothesis testing prob- 
lem because there are many things 
that can happen in an airplane and 
you must be able to sort out all of 
the possible kinds of failures. 
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It may be possible to identify a 
priori certain failure, like stuck 
elevators and stuck ailerons, but 
there may be other types of struc- 
tural changes in the airplane that 
will allow some sort of a limp-home 
kind of capability if some al- 
gorithm or some pilot is smart 
enough to formulate the problem. 

In the L-1011 incident, if we 
read the Wall Street Journal ar- 
ticle and just follow the narrative 
of that story, the Captain and the 
flight crew had to formulate and 
reject several hypotheses. They 
rechecked the stabilizer setting, 
went through a whole series of hy- 
draulic checks, and made several 
other checks. This is very typical 
of the kinds of multiple hypothesis 
testing. 

An audience with aerodynamics 
background may not realize the tre- 
mendous amount of generic problems 
that are involved in the same kind 
of approach. 

Both at MIT and ALPHATECH, we 
are very heavily involved in com- 
mand and control types of problems 
and, in particular, intelligence 
problems. Take an intelligence 
analyst who has some vague notion 
that something is going on that is 
out of the ordinary in the Soviet 
Union. He must formulate a whole 


variety of hypotheses but he seldom 
confirms a hypothesis right at the 
start. We do not have the theory 
to prove that, but one is better 
off in rejecting all sorts of hypo- 
theses and then going on and find- 
ing the correct one. 

Another interesting thing is 
that many failures could be direct- 
ly observed by a sensor if someone 
had the wisdom to monitor that 
particular control element. Quite 
often, if something goes wrong there 
is a little light that will illumi- 
nate to indicate a failure. 

In the L-1011 case it did not 
happen. This leads to the class^^f 
hypothesis testing problems where a 
particular event that we shall call 
a hypothesis either has to be 
accepted or rejected, A direct 
measurement is not made, but must 
be inferred by either the static or 
dynamic interrelationship of 
several other variables that happen 
to be instrumented. 

Given the fact, that we are 
dealing both with static and dy- 
namic multiple hypothesis testing 
problems, then the natural question 
that arises is, "What is the status 
of hypothesis testing theories?" 
Actually, it is quite good, but it 
has never been applied, to my know- 
ledge, with the possible exception 


of sensor failure detection prob- 
lems in aerospace problems. 

Whenever you do hypothesis 
testing, even if we have super- 
duper computers, there still exists 
a very severe compounded, combina- 
torial problem. One cannot possibly 
keep in the computer memory, no mat- 
ter how large it is, all possible 
hypotheses. One has to implement a 
rational procedure to bound both the 
breadth and depth of the hypothesis 
testing tree. 

Given the fact that we formu- 
late several hypotheses and that we 
may have to wait a certain amount 
of time to reject certain hypothe- 


ses and perhaps formulate new ones, 
we are thus creating some sort of a 
growing hypothesis tree which has 
to be pruned. This is a function 
of the computational resources 
available. 

There are some helpful tools 
that people in artificial intelli- 
gence (AI) are using, and that we 
have been using in work in estima- 
tion theory. Every AI problem is 
a clever formulation that even- 
tually disintegrates into a tree 
searching algorithm with rules on 
which way to go to efficiently 
search that particular tree. 
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CONTROL STRATEGY RECONFIGURATION 


* ASSUMPTIONS 

- FUTURE AIRCRAFT VIU HAVE REDUCES STATIC STABILITY PROPERTIES. 

- FVrURE AIRCRAFT WILL HAVE MORE INTEGRATED AERODYNAMIC/ 
PROPULSION SYSTEMS. 

- DIGITAL MULTIVARIABLE CONTROL SYSTEMS MILL BE MANDATORY. 

- IT WILL BE MORE DIFFICULT FOR THE HUMAN PILOT TO COPE WITH 
FAILURES/MALFUNCTIONS OF INCREASED CONTROL ELEMENTS. 


* CONCLUSIONS: 

- MULTIVARIABLE CONTROL SYSTEM MUST HAVE AUTOMATED 
RECONFIGURATION. 


• QUESTIONS 

- WHAT IS THE STATE OF THE ART IN RECONFIGURABLE CONTROL 
SYSTEMS WITH MULTIPLE CONTROLS? 


Let us now talk about the con- 
trols strategy reconf iguration. 
I am not talking about the control 
law. I am talking about the entire 
problem of designing the control 
compensator before you decide to 
change the control gains. There is 
a difference between changing the 
control strategy, the way to con- 
trol a particular system, versus 
the details of specifying the 
numerical parameters associated 
with that control strategy. 

If we make some reasonable as- 
sumptions that we are going to be 


dealing with increasingly unstable 
kinds of aircraft with reduced 
static stability and with integra- 
ted aerodynamic/propulsion kind of 
systems with too many things for 
the pilot to worry about, then we 
must have an automated, multi- 
variable, digital fly-by-wire con- 
trol systems. 

The important thing is that it 
will be much more difficult for the 
human pilot to cope with the closed 
loop characteristics of his air- 
craft. This is a big distinction. 
In the problems that we have seen. 




the airplanes (DC-10, the L-1011), 
and most other commercial aircraft, 
the pilot could deduce something 
because he had just the open loop 
airplane to play with. It is a 
much harder problem if the pilot is 
stuck with both the open loop air- 
plane and a digital control system, 
I think that this is a problem that 
we do not understand. How may a 
pilot be able to deduce that some- 
thing is wrong and reconfigure a 
control strategy by some plan that 
incorporates the airplane with its 
failures together with the auto- 
mated feedback control system? 

I think this is a very big 


question and I do not believe that 
either NASA or the Air Force has 
addressed it at a basic enough 
level as yet to have a good under- 
standing of it. 

We have to think of multi- 
variable control systems that have 
limited reconfiguration capabili- 
ties. At this point we can ask, 
what is the state of the art in re- 
configurable kinds of control sys- 
tems, not only si ngle-input/s ingle- 
output but also multiple controls, 
because there are many more degrees 
of freedom to adequately reconfigure 
control systems. 
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STATUS OF THE THEORY 


* AT IHE PRESENT TIME THERE DOES MOT EXIST A SYSTEMATIC METHODOLOGY 
THAT CAN ADDRESS THE SIMULTANEOUS PROBLEMS OF 

- CONIROL ELEMENT FAILURE IDENTIFICATION 

- STATIC AMD DYNAMIC CONTROL STRATEGY 

RECONFIGURATIGN 

* THERE EUST RECENT (LAST 5 YEARS) THEORETICAL DEVELOPMENTS THAT 
ADDRESS SOME KEY ELEMENTS OF THE OVERALL PROBLEM. 

* A MON-TRIVIAL PROBLEM-FOCUSED RESEARCH PROGRAM IS REQUIRED TO 

- UNIFY DIVERSE AVAILABLE THEORETICAL RESULTS 

- FIU IN GAPS 

- EXTEND THEORY 

- DEVELOP ALGORITtMS 

- SIMULATE 

- DEMCSiSTRATE 


We have talked about the three 
main elements: multivariable type 

of static and dynamic systems, mul- 
tiple static and dynamic hypothesis 
testing, and multivariable control 
systems reconfiguration. You might 
say, "Well Professor Athans, you 
are a theoretician and there are a 
few Ph.D. theses, full of equations 
that are incomprehensible, that we 
see from time to time--what then is 
the state of the theory?" 

We do not have, right now, a 
systematic methodology, much less 
a theory, that can address the 
problems that one needs to have 
well understood, in order to attack 
this problem. It is not a kind of 
an application that you can say: 
"Well this is a problem; it is a 
multivariable control problem, and 


I can find the crossover frequency, 
and I can calculate its maximum 
crossover frequency and do other 
tricks." The control reconfigura- 
tion problem does not fall in an 
easily describable class of solved 
theoretical problems. 

What we do have, again in the 
last five years, are theoretical 
developments that are somewhat per- 
tinent to this problem. I think, 
as a first effort, we need some 
group that is familiar with these 
kinds of problems. Smart people 
have to devote significant time to a 
nontrivial but problem-focused 
research program to unify the 
diverse theoretical results, fill in 
gaps, extend the theory if neces- 
sary, develop algorithms, simulate 
and, of course, demonstrate. 


TOPICS 


• STATIC MULTIVARIABLE CONTROLS 

OIANGES IN EQUILIBRIIH FLIGHT 

• STATIC FAILURE HTPOTHESIS TESTING 

- IDENTIFY FAILURES THAT IMPACT EQUILIBRIUM FLIGHT 

• DYNAMIC MULTIVARIABLE CONTROLS 

- STATUS OF LQG-BASED PLUS GAIN-SCHEDULING CONTROL 
DESIGNS 

• FAULT-TOLERANT CONTROL THEORY 

- STOCHASTIC REGULATION OF LINEAR DYNAMIC SYSTEMS WITH 
OlANGING PARAMETERS 

• DYNAMIC HYPOIHESIS TESTING 

- FAILURE IMPACT NOT DIRECTLY AND IH4EDIATELY SENSED 

• GENERALIZED LIKELIHOOD RATIO (GLR) METHODS. 

• ADAPTIVE CONTROL 


I am now going to discuss in a 
little more detail the different 
topics listed in this viewgraph. 
We will be talking about static 
multivariable control problems that 
are associated with changes in 
equilibrium flight. We will talk 
about static failure hypothesis 
testing — things that you can sense 
as they impact the equilibrium 
flight of the airplane. 

We can talk about dynamic mul- 
tivariable controls such as how to 
design control systems. There is 
one and only one way to do multi- 
variable control system design, and 


that is to use rational Linear 
Quadratic Gaussian (LQG)-based com- 
pensators with gain scheduling. 

We can talk about fault toler- 
ant control. Will sky, while at 
MIT, coined the term which I think 
he sort of borrowed from Draper's 
fault tolerant computing. Work 
that Will sky has been doing and 
also work that I have been doing to 
a certain extent for NASA Ames and 
NASA Langley the last couple of 
years is called fault tolerant 
control . 

I am going to discuss some 
very specific available results 
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that deal with the stochastic 
regulation of linear dynamic sys- 
tems in which parameters change in 
a very real way. This is very in- 
teresting because it is the closest 
theoretical kind of a ball park 
that we have for analyzing the 
problem. We are also going to re- 
view dynamic hypothesis testing 
problems where the failure must 
propagate through a linear or non- 
linear dynamic system and change 
the sensor output. 

In all of these problems, very 
accurate models of the static and 
dynamic characteristics of the air- 
plane must be available. 


I am also going to say a few 
things about generalized likelihood 
ratio (GLR) methods that are inti- 
mately related to dynamic hypothesis 
testing methods. 

The term adaptive control has 
been around since 1955. An adap- 
tive control somehow, either expli- 
citly or implicitly, identifies the 
system on the fly and simultaneous- 
ly changes its control strategy and 
control gains to do the task. 
Finally, what is the status of 
adaptive controls? I would say 
that the control restructuring 
problem is a problem in adaptive 
control . 



MULTIVARIABLE CONTROL SYSTEMS: STATIC 

• START WITH NONLINEAR DYNAMICS 

i(t) ■ £(x(t) ,u(t) Cl) 

VECTOR £ DENOTES OPERATING CONDITION 
f DENOTES FAILURE PARAMETERS 

• ASSUME NO FAILURES (f »0) . FOR DIFFERENT OPERATING CONDITIONS 2 ^’ 
DETERMINE EQUILIBRIUM (STATIC) WHICH DEFINES TRIM VARIABLES 

0 • f(x^ , 0) (2) 

• NOTE THAT IF £|»0 (SOME FAILURE PRESENT) EQUILIBRIUM DEFINED BY (2) 

CANNOT BE MAINTAINED. SYSTEM WILL ATTAIN DIFFERENT EQUILIBRIUM (IF 
STABLE TRANSITION OCCURS) . FOR NEW EQUILIBRIUM IS 

£ ■ iCii' Hi' Ei« 

EQUATION (3) MAY REPRESENT AN UNACCEPTABLE FLIGHT CONDITION BECAUSE 
OF THE VALUES OF . TO CORRECT THIS, THE ^ MUST BE CHANGED. 


I will Show a few equations 
and try to illustrate certain kinds 
of concepts. Let us start with a 
dynamic multivariable control prob- 
lem. Equation 1 is supposed to be 
a global, nonlinear description of 
an airplane where £(t) is the state 
variable vector. We are only talk- 
ing about the rigid dynamics of the 
aircraft but with full nonlineari- 
ties. The symbol £(t) represents 
the vector of control variables 
that in an integrated propulsion 
system include, not only the aero- 
dynamic surfaces, but things like 
nozzles, engine control variables. 


and engine geometry. The symbol £ 
is a certain set of parameters that 
correspond to operating conditions. 
You can think of dynamic pressure 
as being one of the parameters but 
there may be more, especially if 
you have an integrated control sys- 
tem. There is another vector £ 
that somehow captures the failures 
that we are talking about. Somehow 
a few of the important failures, 
perhaps not all sets of failures, 
have to be parameterized. This is 
only natural because an engine-out 
condition is a particular kind of 
failure that everyone knows is im- 
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portant, and pilots get drilled in 
their simulators to overcome that. 
If we build a theory we should be 
able to incorporate that type of 
failure. 

For normal equilibrium flight 
we assume that there are no fail- 
ures (£=0) and different operating 
condition vectors (£j ) represent 
different dynamic pressure regimes. 
Effectively, it is this set of 
algebraic equations, given by 
Equation 2, that defines the set of 
equilibrium conditions and determine 
the trim state and control vari- 
ables. We assume zero failures with 
the system at the particular opera- 
ting condition. How do we trim the 
airplane? What are the results and 
the steady state values of the state 
variables? For example, what is the 
trimmed pitch angle, and the trimmed 
angle of attack? 

Now, if we do have a failure 
shown by the vector f. then 

in general this specific equili- 
brium, (specific set of trim varia- 
bles and specific steady state 
values of the state variables) can- 
not be obtained. Equation 2 cannot 
hold anymore unless you do not 
change your control variables, 
which is what Equation 3 attempts 
to illustrate. If the system is in 
the same operating condition when 


some failure appears, then the sys- 
tem is going to transition from a 
normal equilibrium condition to 
something else. That may be per- 
fectly okay if the transition fol- 
lows a stable trajectory. If the 
set of trim values of the state 
variables remain constant, in the 
transition from the equilibrium 
condition (Equation 2) to the equi- 
librium condition (Equation 3), and 
there is no change of static con- 
trol strategy, the system may drift 
to something different. That may 
be good or it may be very bad, but 
that is how the aircraft is going 
to try to fly. 

In the Delta story, at least 
for a while, the airplane attained 
an equilibrium condition that the 
pilot did not like, but it did not 
stall. In the DC-10 story, the 
plane went to a different equili- 
brium condition, that is, it star- 
ted rolling to the left and went 
around and stalled. That is an 
equilibrium condition that is a no- 
no. 

If the failure caused an un- 
acceptable flight condition because 
of the new equilibrium values of 
the state variables, and this may 
be either benign or very dangerous, 
then effectively the only way to 
take the system out of this equili- 



brium condition and return to an 
equilibrium condition within an 
acceptable set is to retrim the 
airplane. 

For many failures such as en- 
gine take-off failures, then you 
appropriately compensate for the 
loss of the thrust, the rudder, 
etc. These examples are the impacts 
of failures in a multivariable 
sense. The static equilibrium prob- 
lem is in a mathematical framework 
that we can at least use to start 
with since we know a lot about trim- 
ming airplanes. However, I am not 


quite sure if we have really deve- 
loped the knowledge, if you look at 
the true multivariable kind of an 
airplane where you have a variety of 
aerodynamic controls and propulsion 
controls, to generate the set of 
acceptable equilibrium conditions in 
an automated way. We must develop 
this knowledge to decide whether a 
failure puts the airplane in a set 
of equilibrium conditions that is 
tolerable. An inoperable condition 
will require some sort of restruc- 
turing and reconfiguration of at 
least the trim variables. 
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STATIC FAILURE (KPOTKESIS TESTING 


• EXHAUSTIVE LISTING OF FAILURE PARAMETERS 




• M-ARY HOPOTHESIS TESTING PROBLEM CSTATIC) 

• GENERAL TOOLS EXIST FOR SOLUTIONS 

- ALGORITHM COMPLEXITY DEPENDS ON NATURE OF PROBLEM 
CLINEAR VS NONLINEAR) 

- SPEED OF FAILURE DETECTION DEPENDS ON FALSE ALARM 
THRESHOLDS, AND SENSOR NOISE. 


• COMPOUND FAILURES MUST BE TREATED AS NEW HYPOTHESES •> CURSE 
OF DIMENSIONALITY. 

• FUSION/FISSION OF HYPOTHESES: 

- AGGREGATE FAILURES IN FUNCTIONAL CATEGORY CLUSTERS 
(KARO MODELING) 

- DETERMINE CLUSTER (SANDELL-BARAM NEAREST NEIGHBOR 
IDENTIFICATION) 

- DISAGGREGATE (FISSION) CLUSTER 

- NO GENERAL THEORY EXISTS 

- PROBLEM DEPENDENT METHODOLOGIES APPEAR PROMISING 
(C^ APPLICATIONS). 


The next slide deals with hy- 
pothesis testing. If we have some 
good models of the static airplane 
and the quantitative impact of the 
failures, then we may go on to 
another trim solution. We can also 
try to obtain the same autotrim in 
the dynamic sense by putting inte- 
grators in the right place in the 
control loops. 

Suppose the failures are 
listed exhaustively which is a very 
difficult problem. From a mathema- 
tical point of view the problem of 


hypothesis testing, when you do not 
include the correct hypothesis, 
cannot be formulated or solved 
mathematically. You cannot say to 
the mathematics, "gee whiz, I forgot 
to input this hypothesis" — put 
garbage in and get garbage out. 

There are a lot of techniques, 
such as likelihood ratio tech- 
niques, at our disposal for solving 
hypothesis testing problems ^ 

Let us suppose that we can ex- 
haustively list the inputs for the 
failure parameters, then we have 



what is called the M-ary testing 
hypothesis problem in a static con- 
text. In general, tools are 
available for the solution. 
The complexity of the algorithms 
depends on the nature of the prob- 
lem, whether the static problem is 
linear or nonlinear. The speed of 
the algorithm depends on thresholds 
that are intimately related to sen- 
sor noise as well as with the degree 
of confidence that you can assign to 
your mathematical model. 

Notice that compound failures 
as in the DC-10 story have to be 
treated as additional hypotheses. 
Three things went wrong simul- 
taneously. The pilot could have 
handled any one, or perhaps two, 
but not all three of them. In ad- 
dition to loosing the engine, the 
slats were retracted, and there was 
asymmetry that the pilot did not 
know about. The asymmetry alarm of 
the slat system did not function 
and the stall warning system did 
not function. 

If a bird hits us and sort of 
destroys a few things, the problem 
has to be treated as a compound 
failure. This generates additional 
hypotheses, and the only thing that 
limits our ability to do that is 
how clever we are at listing all 
the hypotheses where there are 


single failures or compounded fail- 
ures, within the size and speed of 
our computer. We could never do 
everything we want. 

These problems are not unique 
to airplanes, but arise in many 
places. It is the kind of problem 
that arises extensively in an area 
called multi-objective tracking in 
the surveillance problem for mili- 
tary command and control systems. 
Imagine some sort of airborne radar 
trying to keep track of all the 
ships in the ocean and presumably 
trying to figure out which ships 
are going straight and which ships 
are maneuvering. You may have 
false ships or new ships may 
appear, and quite often you do not 
know which return came from what 
object and this creates a lot of 
hypotheses. For this case, in order 
to handle the curse of dimension- 
ality kind of a problem, people 
tend to apply fusion/fission types 
of hypotheses. 

Effectively, the approach is 
to aggregate these hypotheses, 
which in our case will be failures, 
in certain functional category 
clusters. You can use things rela- 
ted to clustering theory in order 
to be able to tell the clusters 
apart. This approach involves 
modeling which is hard. You must 
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know what you are doing, but in a 
sense it is possible. 

I think from the point of view 
of the airplane, as in the Delta 
1080 flight, if the airplane had an 
automated system, the first thing 
it should have indicated is a prob- 
lem only in the longitudinal axis. 
Well, you may say that this is 
trivial since the pilot knows when 
the airplane is doing crazy things. 
But that is irrelevant. You must 
at least have the algorithms that 
are as smart as the pilot and hope- 
fully smarter. Therefore, the 
fusion part of it is that you take 
a lot of hypotheses and you put 
them into clusters. The next step 
is to determine the correct clus- 
ter. In an aircraft you may say it 
is in the longitudinal dynamics. 
If you want to be more detailed, 
you may say that it will only ef- 
fect the phugoid mode or the short 
period mode, or it is in the 
lateral dynamics. If there are 
many propulsion controls, you may 
say it is an aerodynamic control 
problem, a propulsion control prob- 


lem, or it is a structural failure, 
or something else. 

Although a cluster is not a 
detailed hypothesis, we know how 
certain classes of hypothesis 
testing algorithms will behave. 
They will converge to the nearest 
probabilistic model of the cluster. 
If you did a reasonable modeling 
job, the algorithm should work and 
the theory is available. 

Once you find the cluster, 
which is like doing a tree search, 
and assume that it is on a specific 
branch of the tree, you do not have 
to search that part of the tree. We 
have mathematics that indicate that 
available algorithms will behave in 
a reasonable way if we did a decent 
modeling job. 

Once you find the cluster you 
disaggregate and only deal with a 
small set of reasonable hypotheses 
in that cluster and forget all the 
other things. There is no general 
theory, but many techniques have 
been developed in other application 
areas. The conclusions are very 
much problem dependent. 



MULTIVARIABLE CONTROL SYSTEMS: DYNAMIC 

* LQ6-BASED MULTIVARIABLE CONTROL SYSTEM DESIGNS. NITH GAIN SOIEOULING, 
RELATIVE MATURE DESIGN METHODOLOGY (FOR THOSE NHO REALLY »KW IT) 

* DESIGN METHODOLOGY HINGES UPON LINEAR TIME INVARIANT MODEL BASED UPON 
LINEARIZATION OF NONLINEAR DYNAMICS 

i(t) • f(x(t).uCt),£.f) CX) 

ABOUT EQUILIBRIUM CONDITION TO OBTAIN 

5i(t) • Aj^axj^(t) ♦ Bj^(t) ♦ Wj (2) 

* EACH OPERATING CONDITION (£^) AND FAILURE (f.) WILL CHANGE EQUILIBRIUM 
AND DYNAMICS 

• NO SYSTEMATIC METHODOLOGY EXISTS RELATING 
CHANGES IN EQUILIBRIUM CONDITIONS AND IN 
DYNAMIC SYSTS4. 

- STANDARD GAIN SCHEDULING CONTROL LANS MAY 
BACKFIRE IN THE PRESENCE OF FAILURES. 


We discussed some of the prob- 
lems relating to changes in the 
static equilibrium and some of the 
approaches, namely static hypothe- 
sis testing. Let us go on to some 
of the dynamic issues postulating 
that the aircraft is going to re- 
quire some multivariable dynamic 
control system both in the absence 
of failures and obviously in the 
presence of failures. 

What is the status of the 
theory? I made the blanket state- 
ment that for those who really know 


how to use the LQ6 theory, combined 
with common sense gain scheduling, 
that it is a relatively mature 
design methodology. There are not 
many problems on that as long as we 
can trust that we have reasonable 
linear time invariant models. Fur- 
thermore, we know how to put these 
linear time invariant models in a 
global context through some gain- 
scheduling algorithm. 

Now, how did this design 
methodology come up? We will start 
again with the nonlinear global 
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equations of motion, as I have 
written them before, when we were 
talking about the static problems. 
First linearize about the particu- 
lar equilibrium condition and, in 
the absence of a failure, get a set 
of linearized equations (2). 

However, the thing that I 
would like to warn you about, is 
that there is a very intimate coup- 
ling between changes in operating 
conditions and/or "failures" on the 
one hand and system dynamics and 
equilibrium on the other hand. 
The important thing is that both 
changes in operating conditions and 
the occurrence of certain failures 
are going to change both the plant 
equilibrium and the dynamics. 
Clearly actuator-related failures 
or control element failures are 
going to change the _B^ matrix. 

In control theory we sort of 
know how to deal with the static 
problem by itself, and we can do 
hypothesis testing for the dynamic 
problem and miraculously we can 
linearize it and get a set of 
reasonable models. We can do all 
sorts of things with that including 
failure detection, which I will 
address in the next viewgraph. 

The thing that bugs me is that 
we do not have, at least to my 
satisfaction, a systematic metho- 


dology whereby we can deal, in a 
sense, with this global nonlinear 
problem. We know it is too com- 
plicated to deal with in a global 
manner. How do we integrate the 
static equilibrium kinds of accep- 
table conditions to changes in the 
dynamic model. I do not say that 
this is necessarily hard or that it 
may take ten years to develop, but 
I do not think that it is part of a 
good, overall, generalized metho- 
dology. We sort of hope that changes 
in equilibrium conditions do not 
affect the dynamics of the system 
for the classes of problems that we 
are talking about. I can see that 
certain actuator-rel ated failures, 
like the stuck aileron, stuck ele- 
vator, or something like that, will 
certainly affect the control effec- 
tiveness. However, if the airplane 
loses part of the wing tip or part 
of the tail of the elevator or some- 
thing like that, the matrix is 
certainly going to change. I do not 
know how to routinely go back and 
forth from the nonlinear dynamics to 
static equilibrium to the linearized 
equilibrium dynamic models. This 
poses another set of problems that 
we usually do not think about be- 
cause we are really not flying a 
lot of automated, multivariable air- 
craft. 



It may very well happen that 
rather than disconnecting, we must 
restructure very rapidly the control 
system that made the airplane easy 
for the pilot to fly In the absence 
of failures. The conventional gain 
scheduling control law that Is 
designed In the absence of failures 
may backfire In the presence of 


failures that are not necessarily 
catastrophic. We need some metho- 
dology to understand under what con- 
ditions this could happen. Now, to 
do that we have to understand more 
about gain scheduling laws, their 
nonlinear robustness properties and 
that kind of theory. 
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FAULT -TOLERANT CONTROL THEORY 


• SOME THEORETICAL RESEARCH HAS BEEN DONE FOR LQG-TYPE OF CONTROL FOR 
LINEAR REGUUTORS WITH ABRUPTLY CHANCING PARAHETERS. 

• TYPICAL FORMAT; (ATHANS-BIRDWELL, WILLSKY-CHIZECK) 

x(t+l) - ACx(t))x(t) ♦ B(x(t))u(t) ♦ £(t) CD 
. CCY(t))x(t) ♦ e,(t} (2) 

x(t) : DISCRETE PARAMETER VECTOR THAT "JUMPS" FROM ONE SET 

OF VALUES TO ANOTHER ACCORDING TO A MARKOVIAN CHAIN 



QUADRATIC PERFORMANCE INDEX USED 

• BOTTOM LINE: 

- VERY MESSY CONTROL RESTRUCTURING STRATEGIES CBANKS OF RICCATI 
EQUATIONS) 

- MINIMAL COMPUTATIONAL EXPERIENCE 

- THEORETICAL OVERKILL 

- UNREALISTIC ASSUMPTIONS 


Let us now talk about the sub- 
ject that Professor Willsky calls 
fault tolerant control theory. 
We have done some theoretical 
research in the last five years on 
LQG-type controllers with abruptly 
changing parameters. There were 
two Ph.D. theses: the first by 
Doug Birdwell, who is now at the 
University of Tennessee, and the 
second by Howard Chizeck who is now 
an assistant professor at Case 
Western Reserve. 


There have been some addi- 
tional kinds of research that is 
going on but I just want to give 
you a flavor for the kinds of prob- 
lems and where our research is. 
We start with what looks like a 
standard linear system driven by 
white noise in discrete time and 
with a set of noisy sensor measure- 
ments. But now we make the problem 
more difficult by using a hybrid 
state space system which has a con- 
tinuous state space for the normal 




state variables and a set of para- 
meters, defined by vector 
that is a set of discrete states. 
This vector can attain only a cer- 
tain number of finite, discrete 
values and those are predictable in 
time and can jump from one value to 
another. The probabilistic evolu- 
tion of _y_(t) is described by a 
Markov chain. This certainly is 
what will happen if you have a 
failure. Something changes from 
one value to another at a random 
instant of time. 

What we did, in a sense, is to 
combine the dynamics that describe 
the motion of the state as a func- 
tion of time with a set of dynamics 
described by a Markov chain that 
sort of says that there is a proba- 
bility at each instance of time 
that the parameter vector will go 
from state 1 and remain there or 
will jump to state 2. It can then 
stay in state 2 or jump to state 3. 
It can then stay in 3 or come back 
to state 2 with a certain proba- 
bility or come back to state 1. 
In our mathematical model we can 
write all the transition probabili- 
ties. We have to control a system 
that really is nonlinear, but it 
only looks linear with a continuous 
state space and discrete state 
space. We assume that we cannot 
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influence the transitions of these 
parameters. Obviously you cannot 
do that unless you get outside the 
airplane and fix the elevator to 
resume flight. 

We have worked exhaustively 
using quadratic performance cri- 
teria on this class of problems. 
For anyone that tries to follow 
this kind of work I want to give 
some warning. The mathematics can- 
not stand too much uncertainty. 
If you formulate a stochastic dy- 
namic optimization problem with un- 
certainty in the coefficients of 
the A,B,C matrices, and these sto- 
chastic uncertainties are due to 
jumps according to some Markov 
chain, then this is a multiplica- 
tive kind of uncertainty in the 
basic model. There is another un- 
certainty from the process white 
noise and a third uncertainty from 
the sensor noise. The mathematics 
quits if you try to incorporate all 
three sets of uncertainties. 
You get nowhere with dynamic pro- 
gramming and cannot solve the prob- 
lem. If there is an optimum solu- 
tion that can never be found, what 
good is it? What Birdwell's Ph.D. 
thesis showed was that we could not 
solve the problem with all three 
sources of uncertainty. We assume 
that we can measure the state vari- 
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ables which effectively says that 
the mathematics can deduce from the 
measurements of the state variables 
what the failure parameter is. 
There is a one step inherent time 
delay. 

Pragmatically, you can toler- 
ate a tiny bit of noise, and if you 
have just a slight turbulence, and 
you can measure the state variables, 
and if your failures were somewhat 
significant, you will pick them 
right up with one step-delay. 

A1 1 of the approaches create 
some hedging strategies. There are 
some very messy restructuring 
strategies and we have not been 
able to analyze them over an in- 
finite time interval to deduce glo- 
bal stability properties. Techni- 
cally, you have to solve banks of 
Riccati equations that must be 
solved for linear systems off line 
but if we are going to do any ac- 
tual restructure you may have to 
solve banks of Riccati equations in 
real time. I do not think that 
this is as horrendous a problem as 
it was, let us say, ten years ago. 


In the problem at hand, we are 
saying that we start with a normal 
state and go to a failed state 
which will then induce another 
failure. That is the compounded 
failure problem. A full Markov 
chain may be a theoretical over- 
kill, so we may want to specialize 
this approach to look at the 
classes of problems that we can 
reasonably expect. There are some 
unrealistic assumptions because we 
are assuming that we know the 
probabilities of failure. 

I think that if we are really 
going to have a restructurable 
control law we cannot have just the 
aerodynamicist design the airplane. 
We have to make in a rational manner 
choices about what sensors we are 
going to use for the rigid body 
variables, how noisy they are, what 
failures specific sensors may 
measure directly and which failure 
we have to infer from the available 
sensors. We have to do a complete 
sensor selection tradeoff. And most 
people do not do that in standard 
applications. 
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DYHAHIC HYPOIHESIS TESTING 

• DYNAMIC HYPOTHESIS TESTING NECESSARY WHEN STRUCTURAL/CONTROL ELEMENT 
FAILURE CAN ONLY BE INFERRED FROM DYNAMIC BEHAVIOR OF STATE VARIABLES 

• AAB19I, DC-10 CRASH: LOSS OF ENGINE PLUS RETRACTION OF 
LEFT WING LEADING EDGE SLATS, PLUS NO KARNINGS 

• FAILURE MUST BE DEDUCED FROM INITIATION 
OF ROLL MOTION. 

• DYNAMIC HYPOTHESIS TESTING REQUIRES VERY GOOD AIRCRAFT DYNAMIC MODELS 

- EXPERIENCE HAS SHOWN THAT MULTIPLE-MODEL ADAPTIVE 
ESTIMATION PROBLEMS TENS TO WORE WELL IN THE 
ABSENCE OF SIGNIFICANT DISTURBANCES AND ACCURATE 
SENSORS. 

- NONLINEAR ALGORITTMS POSSIBLE; VERY LITTLE PRACTICAL 
EXPERIENCE. 


The next topic is the dynamic 
hypothesis problems, which arise 
when the failure in the structural 
control element is not directly 
measureable, but has to be inferred 
through the dynamic behavior of the 
airplane. In the American Airline 
DC-10 crash, about the only way 
that the pilot could have figured 
out what was going on is to assume 
that the initial rolling to the 
left was not due to a wind gust or 
some disturbance like that, but 
that it was the initiation of some 
problem. You must have a system 
that is smart enough to indicate 
that. And it can only be inferred 


by measuring bank angle and other 
related variables. 

Good dynamic hypothesis test- 
ing requires very good aircraft dy- 
namic models. I want to stress 
that this is multiple model adap- 
tive estimation and not closed loop 
control. The approach has worked 
very well in several kinds of ap- 
plications that primarily use 
linear dynamics. Sol Gully may 
want to say a few things about this 
and the GLR experience that they 
had with nonlinear dynamics. There 
is not a lot of practical exper- 
ience with nonlinear dynamics, but 
at least we have a place to start. 
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target 1 
X = position 
estimate 

target Z 

A = position 
^ estimate 

y” measurement 


Let us take an example that 
has absolutely nothing to do with 
aircraft. This was a study super- 
vised by Sandell. Let me tell you 
what the problem is to give you an 
idea how these hypotheses trees 


grow and compress, because some- 
thing like that has to be implemen- 
ted if you are going to solve the 
problem at hand. 

This is a problem with two 
ships, both moving with the same 




velocity in straight lines as shown 
in the figure. You can observe the 
position of each ship in the 
presence of additive sensor noise, 
but you do not know which return 
came from which ship. However, you 
want to establish a complete track 
on the ship. Initially there is a 
lot of uncertainty as to the ini- 
tial location of the ship. When 
the ships cross it is very diffi- 
cult to determine the ship that 
returned the signal. The algorithm 
has to formulate this hypothesis. 

In addition to the problem 
that you cannot match the radar re- 
turn, there were two additional hy-- 
potheses: (1) that the return may 

be from a new ship that has not 
been included in the set of hypo- 


thesis which is how you sort of add 
new hypotheses, or (2) it may have 
been a false return. 

In total, there are four kinds 
of hypotheses that are being 
carried around with the algorithm. 
Effectively you run a Kalman filter 
for each one of the combinations of 
hypotheses and that which builds up 
generates growing banks of Kalman 
filters. That is, in a sense, what 
the multiple model estimation algo- 
rithm asks. 

Even for this problem, for 
something like ten data tracks, 
after ten sets of measurements, if 
-you figure out how many possible 
hypotheses you will have, you will 
get something like 10^®, which 
is a pretty big number! 
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A technique was developed and 
implemented by a fellow named 
Keverian to use finite buffer 
memories for that kind of a compu- 
tation, and the algorithm he used 
was based on the artificial intel- 
ligence language LISP. LISP is 
really great for testing hypothe- 
ses, which is the reason it is the 
language of artificial intelligence 
people. Trying to write a Kalman 
filter in LISP was the major diffi- 
culty. The figure gives you an 
idea how the different measure- 
ments, there are sort of like 
eleven measurements and that is 


what scan means, add to the com- 
plexity of the problem. The boxes 
tell you how the memory is filling 
up, and if a box gets filled some- 
thing drastic must be done to cut 
down the size of the tree. Other- 
wise it will keep growing. 

I do not want to explain this 
graph but I do want to give you an 
idea of the kinds of problems that 
you are going to have if you really 
want a superior automated hypothe- 
sis testing algorithm for the air- 
plane. You probably have more than 
the four slots shown in the figure, 
but something like this must hap- 
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pen. You start with some hypothe- 
sis and you begin to grow a tree. 
The tree grows in a particular way 
and some hypotheses get discarded. 
By the time of the third measure- 
ment, the buffer starts to fill up. 
Something drastic must be done. 
Choices are made and hypotheses are 
discarded from Scan 3 to Scan 4. 

In Scans 8 and 9 you can see 
the ships are dose together and 
that is the hardest part in telling 
them apart. You would expect to 
really fill up your hypothesis buf- 
fer and you are forced to make a 


decision. In Scan 9 the buffer is 
still full and all of sudden he 
gets the next measurements. 
The ships have now started moving 
away from each other and the new 
measurements collapse the hypothe- 
ses in Scan 10. 

This process is really fasci- 
nating to watch in a computer. 
It requires certain computational 
tools that aerodynamic control 
theorists are not used to, but in 
many other disciplines these kinds 
of techniques are used day in and 
day out. 
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GENERAUZED LIKELIHOOD RATIO (6LR) METHODS 

• THESE METHODS ARE SIMILAR TO DYNAMIC HYPOTHESIS TESTING ALGORITHMS, 
BUT THEY DIFFER IN ALGORITWOC IMPLEMENTATION. 


* LIMITED EXPERIENCE EXISTS ON THEIR PERFORMANCE 

- MOST GLR ALGORITIMS HAVE ASStMED LINEAR DYNAMICS 
IN MUCH CONSEQUENCES OF FAILURE ARE MODELED AS 
ADDITIVE FORCING TERMS IN THE STATE AND SENSOR 
EQUATIONS OnLLSKY). 


Generalized likelihood ratio 
(GLR) methods are very similar. 
They really are dynamic hypothesis 
testing algorithms, and are similar 
to multiple model estimation but 
with different algorithmic implemen- 
tation. 

A lot of people have experience 
with GLR. Many of the algorithms 
that I am familiar with assume 
linear dynamics and additive sensor 
noise, and the hypothesis impact was 
additive, biasing either the state 
equation or the sensor equation. 


either with steps or ramps. 

Most of the computational 
experience that I have seen is based 
on Will sky's work, the work of his 
students, and also the work at 
Draper that was done on the F-8. 
From the point of view where the 
consequences of failure are modeled 
in a multiplicative way, which I 
think will happen in aircraft prob- 
lems, I do not have any experience 
whether they will work very well or 
not. 
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ADAPTIVE CONTROL 


• EXISTING ADAPTIVE CONTROL ALGORITHMS INVOLVE 

- real time PARAMETER IDENTIFICATION (EXPLICIT OR IMPLICIT} 

- REAL TIME READJUSTMENT OF THE CONTROL GAINS. 

• AVAILABLE ALGORITHMS ARE NOT MATIKE ENOUGH FOR USE EVEN IN THE 
ABSENCE OF FAILURES. 

COMBINATION OF PERSISTENT DISTURBANCES AND UNMODELED 
HIGH-FREQUENCr DYNAMICS CAUSES MOST OF THE ADAPTIVE 
CONTROL ALGORITHMS TO BECOME UNSTABLE. 


The last quasi-technical 
overview viewgraph is on adaptive 
control. We have, as Will sky calls 
it, a bazaar of adaptive control 
algorithms. These include model 
reference adaptive controls, self- 
tuning regulators, and new algo- 
rithms called dead-beat controllers 
developed by Ramadge, Goodwin, 
and Caines. In the last three 
years, several people including 
Dr. Valavani who works partly for 
Eli Gai at Draper and partly for me 
at MIT, have investigated the rela- 
tionships among these algorithms. 

In her thesis for Narendra, 
Dr. Valavani unified a lot of these 
algorithms. For linear, time in- 


variant systems, there is real time 
parameter identification. It may 
be either an explicit least-squares 
kind of identification on the run, 
or some implicit identification as 
in the case of model reference 
techniques. There is also real 
time readjustment of the control 
gains. 

Over two thousand papers have 
been written and a lot of excitement 
generated. You may have seen that 
people are giving courses to indus- 
try on how to make adaptive control 
practical. We have a recent MIT 
Ph.D. thesis [1] finished in November 
1982 that Dr. Valavani and I super- 
vised, which proved with a combina- 
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tion of analytical techniques and 
simulation results that all existing 
adaptive control algorithms are not 
worthwhile. 

The algorithms may look ex- 
cellent if you follow their theore- 
tical assumptions, but in the 
presence of some persistent output 
disturbance and unmodeled high 
frequency dynamics all adaptive con- 
trol algorithms considered become 
unstable with probability one. 

The theory forces al 1 of these 


algorithms, in order to do a good 
job for command following, to keep 
boosting up their loop gains and 
increase the bandwidth. Sooner or 
later, the large gain excites the 
inevitable unmodeled dynamics, which 
by definition cannot be modeled, and 
the adaptive system goes unstable. 
The statement that the available 
algorithms are not mature enough, 
even in the absence of failures, is 
quite an understatement. 
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CONCLUSIONS 


* NO UNIFIED METHODOLOGY/THEORY/ALGORITHMS EXIST 

• NEED PROBLEM-FOCUSED BASIC RESEARCH TO UNIFY EXISTENT RELEVANT 
IHEORETICAL TOOLS. 

• FOR SUPERIOR RESTRUCTURABLE CONTROL STRATEGIES WE NEED A SYSTEM 
INTEGRATION PHILOSOPHY 

- ACCURATE AIRCRAFT DYNAMIC MODELS 

- AERODYNAMIC/PROPULSION CONTROL INTEGRATION 

- SENSOR SELECTION 

- LIMP-HOME STRATEGIES 

- HUMAN FACTORS. MAN-DISPLAY INTERACTION 

* THE PROBLEM IS 

- VERY IMPORTANT 

- HIGHLY NONTRIVIAL 


What are my conclusions? No 
unified methodology / theory /al- 
gorithms exist that can just be put 
in a box and combined with an air- 
plane. Again I repeat that I think 
we need a basic effort that will 
involve talents with more than just 
knowing aircraft dynamics, to unify 
the theory, especially in the unpub- 
lished literature. At the very 
least, we have to address the issues 
for accurate, nonlinear dynamic 
models. This is very important for 
dynamic hypothesis testing. 

I talked about the problem of 
sensor selection before. We cannot 
put sensors on everything, since 
that is an overkill. Then you get 


into the problem that the sensors 
may fail which leads to sensor 
redundancy problems. We really need 
to develop some sensor selection 
strategies at the system engineering 
level. We have to decide if we want 
a computer to try to help the pilot, 
either by suggesting things to him 
or doing something automatically. 

What do we mean by good limp 
home strategies? Also we should 
never forget the human factors in 
man-display interactions. 

The control reconfiguration 
problem is very important and highly 
nontrivial, but I think it can be 
done by people who know what they 
are doing. 
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ROBUST RECONFIGURATION FOR 
HIGH RELIABILITY AND SURVIVABILITY 
FOR ADVANCED AIRCRAFT 


Thomas B. Cunningham 
Honeywell, Inc. 
Systems and Research Center 
Minneapolis, MN 55408 


Introductory Remarks 

We have had some experience in 
the past with reconf igurable/ 
restructurable controls. I guess 
the main message for today's talk 
is that there is bad news and there 
is good news. The bad news is that 
most of the emphasis in this area 
at Honeywell has been on military 
aircraft. However, we have had 
some experiences recently with what 


we might be looking at in the 
1990 's transport commercial air- 
craft. And we see a lot of trends 
that are very similar to experien- 
ces that we are going through or 
have gone through with military 
aircraft. To that end, the good 
news, therefore, is that I think a 
lot of things in the military carry 
over to civil aviation .1 will try 
to point these out as I go along. 


MOTIVATION 


0 Reliability 
0 Survivability 


So given that, the title of my 
talk is Robust Reconfiguration for 
Higher Reliability and Survivabili- 
ty for Advanced Aircraft. The 
first thought was that survivabili- 
ty real ly does not have much to do 
with this. But I think that, as we 
get into it, we will find that the 
military's parallels with surviva- 
bility also have an impact on what 
we are looking at here. Take the 
DCIO incident, for instance. This 
incident involved a dispersion 
problem in the hydraulics of the 


leading edge slats. They also had 
a problem as to which direction the 
slat failed. One of the issues in 
survivability of military aircraft, 
particularly the kill-given-hit 
survivability, is dispersion of 
things like hydraulics. 

So as I mentioned, certainly 
the reliability aspects of the 
problem are part of the motivation, 
and in this case, survivability 
issues would also apply to commer- 
cial transports. 
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PCS RELIABILITY (Sensors, Computers, Actuators) 


1- SENSORS 

- Proliferation of onboard strapdown sensors for PCS sharing 

- Standard RM proven on many systems 

- Analytical Redundancy is going into production systems 
* Robust reconfiguration feasibility demonstrated 

2. COMPUTERS 

- Computer self test is S.-O.-A (~97X) 

- Pault tolerance ■►gatelevel 

- Software V&V evolving but still a problem 

- Distributed arch, of cheap fault tolerant building blocks offer advantages 

3. ACTUATORS - Clearly the Reliability Bottleneck 

- Analytical methods enhance actuator reliability 

- Localized processing feasible 

- Restructuring of PCS surfaces will have big payoff 


I would like to, first of all, 
look at reliability as it is cur- 
rently assessed, say in aircraft 
flight controls. This I think is 
basically common between the mili- 
tary and the commercial world. 
This is how we assess it at Honey- 
well, anyway. For military air- 
craft in particular and say the new 
767 aircraft that Boeing is build- 
ing, we are seeing a proliferation 
of onboard strapdown sensors that 
are available for flight control. 
I am going to discuss sensors very 


briefly and maybe touch on a couple 
of things in the computer area that 
might be of benefi-t to us and then 
go on to the actuator/surface prob- 
lems. 

Standard redundancy management 
has been proven on many systems 
with highly automatic flight con- 
trol systems. Analytic redundancy, 
defined as the type of thing that 
has been developed mostly at 
Draper, is now going into produc- 
tion systems. One of the questions 
I am asked (I am sure Draper is 



too) is when is this stuff going to 
become real? It is real. It is 
here now and the technique has been 
proven in flight tests, and I know 
of at least one Honeywell system 
that is going into production. 
I believe it is being accepted. 

Robust reconf iguration feasi- 
bility has been demonstrated, at 
least in the study arena through 
simulation, for advanced fighters. 
We have been able to show that you 
can take sensors in off-nominal 
positions and normalize them to the 
proper place to at least get some 
semblance of reasonable flight 
control . 

Now let us discuss computers. 
Most of our emphasis in recon- 
figurability is going to end up in 
some sort of algorithm, i.e., we 
are going to create software. 
The question is do we have the 
hardware capability to implement 
that software. Many people say no. 

I think certainly the state of the 
art in computer throughput is 
coming around to being able to 
accept more advanced algorithms. 

More software for reconfigura- 
tion, however, places an even 
heavier burden on computer fault 
tolerance than ever before. Com- 
puter self test is state of the art 
to about 97 percent and computer 
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fault tolerance is rapidly improv- 
ing. For instance, the new chip 
designs will have fault tolerance 
down to the gate level whereas the 
current day processors are fault 
tolerant basically at the box level 
in terms of self test. 

We could talk about software 
validation and verification for 
hours. It is evolving but it is 
still a problem. It is going to be 
a problem for all of us who gene- 
rate algorithms in particular. 

Distributed architecture of 
cheap, fault tolerant building 
blocks offers advantages. A number 
of people are working on distri- 
buted architectures, and this could 
be dispersed architectures also. 
Things like computational elements 
at the actuator positions themselves 
offer nice ways of implementing a 
lot of fault tolerance, not only for 
the hardware itself, but actually 
for the actuator surface positions 
themselves. In one of the acci- 
dents that was discussed today (the 
L-1011) as Mike Athans pointed out, 
there was no sensor available. 
Well, there was no sensor on board 
the aircraft. In military aircraft 
and future commercial aircraft we 
are going to see a lot of LVDT's 
around the airplane. Now, unless 
that particular sensor itself fails. 
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we should be able to detect, just 
from normal operation, particularly 
in a statically unstable vehicle, if 
a surface is not moving and perhaps 
if it is stuck in a very adverse 
position. This concept could be im- 
plemented in an actuator micro- 
processor. 

Anyway, the notion of distri- 
buted architectures offers a great 
deal, and with it we can solve 
some of the environmental problems as- 
sociated with computers. We will be 
seeing processing elements out in 
various spots along the aircraft, 
certainly around the actuator posi- 
tions. 

The current state of the art 
in flight control is such that the 
actuators themselves are the relia- 
bility problem. At SAAB in Sweden 
they are starting to look at that 
in some of the newer production 
aircraft. They will be using a 
kind of the equivalent to analyti- 
cal redundancy in the actuator 


world. Some of the theoretical 
issues are actually a lot easier to 
deal with, but the impact, as we 
know, of a handover actuator or a 
handover surface is much more 
severe than a failed sensor. 
Localized processing is feasible, 
but I think that is related to the 
hardware issues. Restructuring of 
flight control surfaces can have a 
big payoff. If you compare surface 
redundancy management with sensor 
redundancy management, it is very 
unlikely that we will be adding 
surfaces onboard aircraft just for 
redundancy, particularly in military 
aircraft. I think that the same is 

true for highly augmented, future 
commercial transports. To add a sur- 
face just for redundancy would so 
effect the primary system perfor- 
mance that it might be unfeasible, 
whereas the sensors will prolife- 
rate. We are, however, adding sur- 
faces for primary performance. 
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THE SERVO/ACTUATION BOHLENECK 



A-7 MISSION RELIABILITY 


Redundancy 

Current A-7 Digital 

A-7 Digital with 
Analytic Redundancy 

A. 

Either coMPUTEB 
FAILS (with 95!S 
TEST coverage) 

.2 X 10"'* 

.2 X 10"^ 

B. 

Either servo fails 

IN ANY AXIS 

6 X 10'^ 

6 X 10"^ 

C. 

Either gyro fails 

IN ANY AXIS 

6 X 10"^ 

.3 X 10"^ 

D. 

Either normal 
accelerometer 

A X 10"^ 

.02 X 10"^ 





TOTAL 

12.6 X 10"^ 

6.52 X 10"^ 


The next viewgraph just shows 
basically a demonstration of the 
overall reliability bottleneck. 
Those of you who worked with the 
energy efficient transport of the 
lAAC program know that the overall 
failure, crucial failure reliabili- 
ty specifications on that is about 
10~9. This is a very difficult 
reliability specification to meet. 
The military has been dealing with 
stringent reliability specifica- 
tions longer so in this particular 
case I have drawn some numbers from 
an old A-7 study that we did. 
For this study, a flight test of a 
set of dual computers that we had 


on board the aircraft pretty much 
solved the computer reliability 
problem as shown by these simple 
numbers. If you look at the other 
control elements such as the gyros, 
accelerometers, and servos, they 
all pretty much have the same reli- 
ability figures. However, we did 
some designs using analytical re- 
dundancy techniques and basically 
got reliability improvements for 
the gyro and normal accelerometer. 
Now the bottleneck becomes the 
servo area. That, certainly in 
terms of the military flight con- 
trol technology, is the bottleneck. 
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FCS SURVIVABILITY (fklU^IT) 


0 SENSORS 

- Dispersion normw.ization feasibility demonstrated 

- Reconfiguration feasibility demonstrated 

0 CCMVIERS 

- Dispersion easily ifplifented with distributed processors 

- C0M>ARTMENT ENVIROrtCNTS NEED EXAMINATION 
0 ACTUATORS 

- Surfaces for primafn control functions proliferating-RSS, GLA, Ride 

SMOOTHING. FMC. AND DIRECT FORCE MODES 

Utilize surface restructuring to maximize mission goals 

- Engine technologv advances 

- Thrust vectoring 

- High bandwidth thiust control 


We have had some experiences 
with survivability which I think 
have some parallels to this issue 
that we are discussing today. 
Again, I first want to review where 
sensors and computers are before we 
get on to the actuator portion. 

There has been some simulation 
demonstration of being able to 
reconfigure and configure flight 
controls based on normalization of 
dispersed sensors put in nonstandard 
positions. This has been examined 
by using navigation sensors for 


flight control where the NAV boxes 
essentially dictate where the sen- 
sors can be. So, as I mentioned, 
reconfiguration with dispersed sen- 
sors is possible. Computer disper- 
sion is easily implemented with 
distributed processing. 

Dispersion of elements in com- 
mercial flight control is also use- 
ful. The combination of failures, 
for instance, that occurred in the 
DC-10 disaster could have been 
avoided had we thought about disper- 
sion a little bit more with certain 




key elements. 

One of the key issues on com- 
puter dispersion is the environmen- 
tal issue. Surfaces for primary 
control functions are proliferating 
in military aircraft. In the mili- 
tary, we are not too worried, at 
this point in time, about adding 
surfaces to auto-reconf igure out of 
a bad or impossible situation. 
We have an evolution that has oc- 
curred over the past 10 years where 
we now have a number of surfaces on 
board the aircraft that could con- 
ceivably reconfigure for a reason- 
able control of the aircraft. This 
could apply in commercial aviation 
if we go through the same trend of 
relaxing the static stability 
(RSS), implementing gust load alle- 
viation (6LA), and perhaps some 
ride smoothing. Flutter mode con- 
trol (FMC) is also being looked at 
in the commercial area. All of 
these add surfaces to the aircraft. 
I do not think we will see any 
direct force modes for the time 
bei ng. 

There are some other trends in 


technology that I think we can make 
use of here. Engine technology is 
now heavily going into the hard- 
ware end of thrust vectoring. 
The military is seriously examining 
this. Another new idea that is 

coming about is some capability 
with the engines to provide higher 
bandwidth thrust modulation. This 
would be important if we wanted yaw 
or roll control from differential 
engines. For commercial aircraft 
vs. military air craft, we are 
really just talking about a lower 
bandwidth, a lower set of frequen- 
cies that we are dealing with. 
I think the current state of the 
art in engine controllers is suffi- 
cient to have knowledgeable retrim, 
say if you have a hardover left 
or right stabilator or elevator. 
However, we are going to have to 
look at things like higher band- 
width thrust control to get any 
kind of additional yawing moment 
out of the system. And we see the 
engine people starting to evolve in 
that direction also. 
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PRELimrWY SURVIVABILITY ISSUES 


0 FREE SURFACES REOJIRE 


rEEDS imiOVING 


- Stable Hinge Moments 

- Surface Dafpers 

0 HYDRAULIC POWER DISTRIBUTION 
0 HIERARCHY OF SIRVIVABILITY 

1. Mission Continuation 

2. Optimum Return to Base 

3. Landing 

A. Trim to Fly 
5. Engine Out Glide 


Full MilBTBS Specs 
Level II Flying Qualities 
Level III Flying Qualities 

< Level III Flying Qualities 

< Level III with Auxiliary Po€r 


The next chart shows some key 
preliminary issues. This first bul- 
let emphasizes some things that I 
have heard this morning already. No 
amount of control theory, failure 
detection theory, etc., will be able 
to help you recover if you have a 
big surface that is hardover. In 
the case of a military aircraft, 
they mostly use the whole stabilator 
for pitch control. I think the 
L-1011 was fortunate in that they 
only use partial surfaces. A lot of 
research was done at the end of the 
Vietnam area on how to handle air- 
craft control problems once you have 
lost major surfaces or the use of 


major surfaces. One of the conclu- 
sions on a study of the F-4 was that 
if you had a hardover stabilator, 
there was nothing that you could do 
to recover. There are a couple of 
horror stories about what pilots did 
do to get out of situations like 
that. 

One of the evolving techniques 
to handle a free surface now is to 
use surface dampers. The idea is 
that if you do have a free surface 
that has a stable hinge moment, if 
you do lose actuator power to that 
particular surface, you would in- 
sert a damper, or it automatically 
is inserted, into the system so 



that the surface does not flutter 
or cause a major difficulty. 

Hydraulic power distribution, 
even in current military aircraft 
such as the F-16 and the YF-17, 
does need some improving from the 
survivability standpoint. I think 
the DC-10 experience has shown us 
that some different hydraulic power 
distribution could have helped out 
in that situation also. 

What is interesting here is 
the hierarchy of survivability for 
a military aircraft, which also can 
have some parallels. For instance, 
we looked at mission continuance in 
a MIL-SPEC sense. Mission continu- 
ance means that you have as much of 
the primary flight control capa- 
bility as you originally had on the 
aircraft still available. The next 
notion is that of an optimal return 
to base, and here, of course, you 
are dealing with an enemy that 
keeps shooting at you or something 


like that. Landing requires some 
level III flying qualities under 
nice conditions. However, what is 
interesting here is that, if you 
are able to trim an airplane, you 
can get a lot of flying capability 
out of that vehicle, even though 
you do not have good flying quali- 
ties. I think the L-1011, for 
instance, was probably in this 
particular category. As you know, 
Los Angeles airport is susceptible 
to wind gusts on some days. If he 
had had gusty conditions out there 
on landing approach, he may not 
have made it. However, a combina- 
tion of nice weather conditions and 
“being able to recapture some sem- 
blance of flying qualities as he 
landed the aircraft allowed the 
pilot to save the aircraft. 
The fifth point [engine-out glide] 
maybe has no parallel here. It is 
of importance in the combat air- 
craft world. 
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C SURFACE RECONFIGURATION DESIGNS ^ 


EXAMTLt 1 - MUMMM DIWIISED AMD RECONnMUMILE 
EXAMPLE 2 - HONEYWELL YP>1S REVERSIOM MODE HUOY 




We have looked at surface re- 
configuration and next I am going 


to talk about a couple of military 
fighters. 
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The first story is kind of in- 
teresting. It was actually done by 
Grumman on a statically unstable 
version of their F-14. This, by 
the way, has no paralle.1 with the 
production F-14 aircraft. This is 
the basic setup of flight control 
surfaces available to a pilot, say 
in an F-14. His major pitch sur- 
faces of course are two stabi la- 
tors, independently actuated. Roll 


control is performed by combina- 
tions of spoilers and a rolling 
tail, achieved with differential 
deflections of the stabi lators. 
He has a set of upper and lower 
speed brakes. He has glove vanes 
at his disposal although these 
quickly drop out as available 
sources for reconfiguration. 
Of course he also has twin rudders. 
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R-14 REVERSION MODES 


control 

Function 

Pitch 

Control 

Roll 

Control 

Yaw 

Control 

Prlmorjr 

Collactlvo tall 

Differential 
tall plua 
apollera 

Dual ruddera 

BeoommondabU 

•Iternato 

aurfaoo 

configuration 

Redealgnad 
•paad brolMt 

Dlfforentlal tall 
alone wltti 
speUera out 

Single rudder 

Mode 

flying 

qualltlea* 

Lavel 3 

. Level 1-3 

Levels 


Here 1s what they found out 
when they looked at what would hap- 
pen if they lost certain controls, 
and these are just single failure 
events. I have already mentioned 
the primary control surfaces. If, 
for instance, you lost pitch con- 
trol due to one of the stabilators 
going out, then you have a mistrim 
in all axes. The recommendation 
was that, if you wanted to try and 
reconfigure for an event like this, 
you had to redesign the speed 
brakes because they did not have 
enough control authority as origi- 
nally designed. In this particular 
case, controlling pitch with the 
remaining half of the stabilator 


would cause such a roll problem 
that spoilers alone did not have 
enough roll control power. So the 
idea was to try to get back to 
another pitch surface. Here the 
recommendation was that they re- 
design the aircraft with high band- 
width actuators, certainly on the 
speed brakes, and actually make the 
lower speed brake a little larger 
and they could achieve level III 
flying qualities in pitch. 
The message here is that there are 
some things that one can do in pre- 
liminary design of a vehicle that 
can offer some high payoff rever- 
sion modes. 




Let us now look at the second 
example. Here we looked at the 
General Dynamics F-16 fighter. 
In the particular case of the YF-16 
the data we used was for the CCV 
aircraft which has a vertical 


canard which can be 

used in 

the 

-lateral directional 

axi s. 

Here 

the primary 

control 

surfaces 

in- 

elude the 

vertical 

canards. 

the 

flaperons. 

horizontal 

tails. 

and 

rudder. 





56 




YF-16 Reversion Modes 
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In this case, whether by 
design, we do not know, a lot of 
reconfigurability is possible. 
I will just skim over our results. 
First, we assumed that failed sur- 
faces had stable hinge moments. 

In all cases shown we were 
able to reconfigure on the remain- 
ing surfaces and get back to some 
level of good flying qualities just 
by reconf iguring on the other sur- 
faces. For instance, if you only 
had one half stabilator, i.e., you 
lost the other half stabilator, you 
could use a new feedback control 
law on the remaining stabilator. 


use crossfeed to the flaperons and 
rudder, and achieve some semblance 

of flying quality for pitch con- 
trol. You would still have the 

flaperons for roll control and you 
would have the rudder primary sur- 
face for yaw control. 

In all cases, when you lose 

surfaces, you lose some perfor- 
mance. There is something that has 
to drop out. If you had no loss in 
performance due to a loss of sur- 
face, then you probably did not 
need all the surfaces in the first 
place. For this particular air- 
craft, they had some direct lift 




modes and they had some direct side 
force modes. They could retain some 
of the modes and had to drop the 
others. You can peruse the rest of 
these later on. 

In summary, after the loss of 
a surface on an actuator on a sur- 
face, we could rationalize recon- 


figuring on the remaining surfaces. 

Now, both aircraft discussed 
were statically unstable. I have 
talked to people at Boeing who tell 
me that there is a good possibility 
that the next commercial transport 
will be statically unstable also. 
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FUNDAMENTAL GOALS OF CONTROL 


• DESIRED COMMAND RESPONSE 

• DISTURBANCE REJECTION 

• PLANT STABILITY (WHERE REQUIRED; 


Next, I would like to quickly 
go through a design method that we 
use at Honeywell for designing con- 
trol laws and then finish up with 
an attempt to show how we would 
bring that all together for a re- 
configurable set of control systems 
for advanced aircraft. We have to 
start with the fundamentals. 
The fundamentals of control are. 


desired command response while 
looking at disturbance rejection 
and plant stability, where re- 
quired. I certainly do not want to 
upset my stability with the control 
system design, but we are facing an 
era where, open loop, many air- 
planes in the future will be un- 
stable and we have to worry about 
that particular issue. 
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C* FEEDBACK LOOP 


OTWIMWCW Wl 



We start with a classical con- 
trol loop diagram. The diagram 
does not change even in the modern 
era. We have a plant which we will 
represent by G, a sensing mecha- 
nism, and a set of actuators that 
can be embedded in the plant. 
We have some sort of feedback con- 
trol structure, and we have a feed 
forward command structure. Now, I 


have shown C* here. My military 
friends and flight controls col- 
league tell me that this is pretty 
passe now. You will forgive me, 
but I think for the purposes of our 
discussion this is not important. 
We have some error in the sensors 
represented by the noise. We have 
some disturbances going into the 
aircraft (wind gusts, etc.). 
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C* ENVELOPE 


Ride Quality: MIL-F-9^90 
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For those of you who are not 
familiar with C*, the idea is just 
to get into the envelope shown. 
However, we have more than one 
design goal in the pitch axis of an 
aircraft. The other one is the 
MIL-F-9490 ride quality index. 
You can talk about gust load alle- 
viation, which is certainly a pitch 
axis problem, and some other form 
of load control in the pitch axis. 


3o we may have multiple goals for 
our future aircraft flight control 
designs. Multiple goals are best 
implemented with multiple surfaces. 
Admittedly you can attempt to im- 
plement all these goals with one 
surface, and in some cases you can 
do that. Gust load alleviation and 
ride quality, for instance, can be 
implemented typically with one set 
of surfaces. 
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FEEDBACK IMPROVES PERFORMANCE 
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lORS 


The idea for a single goal now 
is, in terms of the feedback per- 
formance issue, that we would like 
to have the actual commanded spec 
performed to a given command input 
to a certain error tolerance. 
In terms of feedback reality, L 
represents the combination of the 
control compensation and the plant 
of the vehicle itself with all its 
uncertainties. This simple equa- 
tion really describes what is going 
on and you can see, quite simply, 
what happens. We would like to 
minimize this function to distur- 
bance inputs, which may be big, and 
to command levels, which could be 


big also. And you can see quite 
simply that one way of doing this 
is to make L big, that is, high 
gain feedback. It certainly would 
support the goal. Another thing we 
want to avoid is transmitting all 
that noise into the system. There- 
fore we have certain constraints on 
L here. 

Some meaningful consequences 
of all this is that | 1+L | is rela- 
ted to our spec in this fashion 
here, where your L is defined as 
the product of GKT. Now, one thing 
that I have not introduced is that 
L has certain errors. In the case 
of reconf igurable controls, one 



might postulate designing a single 
feedback control that would be 
robust to all failures. Such a 
notion is kind of ridiculous, I 
think. But we may want to look at 
certain types of failures that we 
could handle just by the basic 
feedback control. Actually, some 
people have studied this problem. 
The aL here normally represents 
just the normal uncertainty of the 
plant, which is considerable for a 
lot of airplanes. This could 
represent, in the normal sense, 
just the uncertainty with the 
structural model in which you have 
high frequency modes, the parameter 
uncertainties that you have after 
you have done your analysis and 
really do not know the vehicle, the 
actuator characteristics, etc. 
What I would like to throw in just 
for the sake of argument here is 
the possibility that the aircraft 
is changing, somehow, due to a 
failure. So, one can postulate, 
that one look at, say, a control 


system surface failure, using this 
model. I do not think that this is 
a very wise thing to do because G 
would change its dimensions. 
For instance, if you lose one whole 
row of G, you would have a signifi- 
cant change in the particular para- 
meter by doing that. Other types 
of failures you might try to handle 
would be partial surface loss- 
maybe losses due to clipping the 
rudder off the control tower, or 
losses resulting from some sort of 
mid-air collision. Certainly, I 
have heard about some experiences 
with fighter aircraft in World War 
II where you actually lost part of 
the vehicle and yet you were able 
to maintain flight. In those cases 
they just got lucky, because there 
was no notion of feedback. So 
there are some things that you can 
look at just from the standpoint of 
feedback control that might enhance 
the robustness to certain types of 
failures. 
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I do not want to expand on the 
fundamentals of feedback control. 
I tend to agree with Mike. 
The situation is well at hand for 
those of us who have been using it 
for a while. I want to bring up 
the notion of singular values. 
For those of you who have never 
seen it before, it is basically a 
measure of the size of a matrix. 
And, in this case, you think of the 
old classical notions, of gain and 
phase margins. The gain is the 
size of a single-input/single-out- 
put transfer function in complex 
space. If you are looking at the 


multi-input/multi-output role, you 
no longer have a single complex 
number. You are dealing with a 
matrix. So, how do you get from 
the classical notion of gain in the 
single-input/single-output role to 
the multi-input/multi-output role? 
The idea there is that you have got 
to look at a measure of how big 
that matrix is. 

For instance, suppose the in- 
put to a GK, or some sort of a loop 
transfer relationship, is on the 
unit sphere. I am just showing a 
two-by-two system here that has unit 
magnitude. Then its output would be 


an ellipse. One useful way of 
measuring the size of the ellipse, 
short of actually going through and 
looking in every possible direction, 
is to measure its minor and major 
axes. And the singular values in 
this particular case are measures of 


the major axis represented by the 
maximum singular value and of the 
minor axis represented by the mini- 
mum. So what we try to do is relate 
control system design parameters to 
how they respond in terms of the 
maximum and minimum singular values. 
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For instance, the same conse- 
quences we talked about before could 
be represented here. If we wanted 
to ensure that we could meet our 
performance goals, we would look at 
the minimum singular value of the 
loop transfer, in this case (I + L), 
to make sure that it was above our 
spec. In the case of robustness, we 


have to assure that the minimum 
singular value of (I + L) is greater 
than the maximum singular value of 
our perturbation. We will show some 
graphical interpretations of that. 
For instance, if L is very big, the 
minimum singular value has to be 
large also; likewise for noise 
properties. 
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and C*. In the commercial world 

these might be just the normal 
handling qualities that we need of 
a relaxed static stability aircraft 
plus either ride quality or gust 
load alleviation, depending on what 
is advisable, at that point in 
time, in the pitch axis. Now we 
represent it as a matrix block 
diagram and we have the matrix 
This might work in a system elements j< and So we generally 

where we have two design goals. have the same sort of situation as 

Now, let us say that we had two we did with singular control but 

design goals here, the ride quality now in the multi-input world. 
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I would like to move on to some 
graphical interpretations of this. 
Performance goals, coupled with the 
uncertainty of the model, tend to 
give us certain regions where we 
would like the loop gain to fall. 
In the single-input/single-output 
role, we know that we would like 
high gain at low frequency, and we 
would like to roll off very nicely 
at high frequency. We would like 
good crossover properties. In this 
particular case, the commanded boun- 


daries are representing C* and ride 
quality. The flight control hand- 
ling quality issues typically tend 
to be at lower frequencies than gust 
load alleviation, so then I am just 
kind of generically representing 
that. We can meet our spec by 
ensuring that our minimum singular 
value is above this region here. 
Likewise, we have to be certain that 
we do not violate the bounds in 
frequency, in particular, of where 
we do not know the system. 



MULTI LOOP DESIGN OBJECTIVES 



FRfautMCY (Hi) 


Now, what I would like to do 
is to relate this to our control 
system failure problem. If we lose 
an entire surface, the uncertainty 
goes across the entire frequency 
spectrum. Using the same control 
law quite likely will mean that we 
violate our uncertainty principle 
here. We no longer are dealing in 
a region where the maximum singular 
value can be achieved. If we do 
have some partial surface failures, 
particularly if we get into some 


flutter conditions, which is typi- 
cally represented out here in high 
frequency, we may be able to 
recover from something like that 
with the current control law. 
Jurgen Ackerman of Germany has 
actually looked at the design of 
feedback control laws that have in- 
tegrity to such failures. For in- 
stance, one of the primary goals of 
the control law is to be stable in 
the event that he loses a surface 
or a sensor. Some of the results 
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are nice, but, unfortunately, I 
think he has compromised much of 
his primary system performance by 
imposing this integrity. For those 
of you who are not quite clear on 
this, the integrity in this sense 
means: what if I lost the use of a 

surface, but I did not detect it or 
isolate it, and I just wanted to be 
assured that the control system 
would be stable in the face of that. 
Now such things are possible, but I 
think that in the long run, we 
sacrifice too much system perfor- 
mance. -So the idea of detecting, 
isolating, and reconfiguring cer- 
tainly has more merit because "full 
up" primary performance is not com- 
promi sed. 


This is just one way of showing 
the impact of the current control 
law, assuming you are using feed- 
back. Now, admittedly, current 
transports do not need feedback to 
remain stable. Future transports, I 
think, will have to. So, it is a 
way of saying that if you have got a 
good high performance control law in 
the primary loop, it is likely to 
have bad performance in the rever- 
sion modes. Of course, if you had 
low gains, if your command boun- 
daries are really low and dictate 
low gains, you can probably survive 
a lot of changes at high frequency. 
However, the trends for highly aug- 
mented aircraft is certainly not for 
low gains. 
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LQG-BASED DESIGN METHODS 


SUGGESTED 

LQG DESIGN PROCESS 
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The next set of viewgraphs 
basically talks about our approach 
to control law design. We have a 


technique using the LQG methodology. 
Gunter Stein, of our staff, has been 
looking at the problem quite a bit. 
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The inventor's intention here was 
basically time-domain optimization, 
where you can use the mathematics of 
linear, time invariant state space 
representations to minimize a cer- 
tain performance index. This has 
always had some nice mathematical 
properties. Unfortunately, it is 
terrible from the standpoint of 
designing control laws because we 
have to deal with an uncertain 
world. It is great for modeling and 
it is great for computer synthesis 
of control laws because of the 
computer-nicey things like A's, B's, 
C 's and H's. 

However, the real world is 
handled better in the frequency 
domain. And what Gunter has shown 
is that you can get a frequency do- 
main interpretation of this. For 
instance, this K compensator can 
merely be put in terms of the ori- 
ginal A matrix, the B matrix, the C 


matrix which is the output coupler 
(these are the actual measurements 
that you have), and certain gains. 
This Kc is the full -state control 
law gain and this Kf is some sort 
of observer of gains that you have 
in the feedback loop. 

The idea here is that you want 
to design this compensator to have 
good frequency domain properties 
like the ones I alluded to on an 
earlier viewgraph. There are nice 
techniques for doing that, parti- 
cularly for the singular values. 
You shape the particular K(s) to get 
good singular values of that. The 
issue we have been discussing here 
is whether that is even possible, in 
the face of such a massive change in 
the G matrix, to remain stable. The 
contention is that under certain 
failures this is true but under 
others it is not true. 
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I would like to allude to one 
other particular thing that we have 
had some success with. This may 
create a little controversy after 
Mike Athens' statement about adaptive 
controls not working. Unfortunate- 
ly, we have demonstrated adaptive 
control once or twice inflight and 
tested it in the wind tunnel. I 
think we have some really dreadful 
concerns about the way we are doing 
this. We ought to let the people at 
NASA Dryden and the people here at 


the wind tunnel know about it, i.e., 
maybe we should stop showing that it 
does work. 

I think there is a good reason, 
however, beyond the controversy, 
for why this is working. Hopefully, 
we will do something current so 
Mike can criticize it. In any 
case, it works. A couple of ex- 
periences we have had with adaptive 
control bear some relationship to 
the problem we have talked about 
here. 
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The primary parameter identifi- 
cation portion of adaptive control 
is basically the technology we are 
developing. The control law imple- 
mentation part of that was a highly 
bounded implementation. We used it 
for gain scheduling of the existing 
control laws with very significant 
bounds on how far those gains can 
travel, i.e., we did not let the 
system go unstable. The F-8 adap- 
tive control law involves identi- 
fying surfaces effectiveness for 
gain scheduling. And the bottom 
line is that it works quite well. 
For the control laws in the F-8, the 
identification, particularly of the 
surface effectiveness of 
the elevator, was quite sufficient, 
and quite accurate enough to allow 
us to gain schedule throughout most 
of the flight envelope. I am not 
sure we tried the landing approach 


on the flight test data. I would 
have to check on that. We certainly 
ran through most of the flight 
conditions. In this particular 
case, surface effectiveness has a 


very 

nice linear relationship 

to 

q- 

So you might say 

that 

we 

were 

identifying q in 

1 i eu 

of 

the 

air data system. As 

it turns 


out, that was the logical result. 
We could replace the air data system 
or we could do a reversion onto that 
air data system if it failed. 

Real-time, on-line identifica- 
tion to try to detect changes in 
surface effectiveness of vehicles, 
however, requires test signals. 
These parameter identification 
schemes, by definition, go unstable 
if you do not provide some known 
excitations to the systems. That 
has been our experience. We did 
find, however, on the F-8 that the 
test signals required for that sys- 
tem were low enough that we did not 
upset the pilot's riding qualities. 
He did complain about it because 
there is an angle of attack nose 
boom out in front of the airplane 
and it started to wiggle. 

Another adaptive control pro- 
gram that we have worked on with the 
Northrop Corporation that has had 
some success, and that I think might 
relate to our discussions, is what 



we call the adaptive control of 
wing/store flutter. The Air Force 
was and is interested in trying to 
maintain flutter mode control of an 
aircraft over an exhaustive number 
of stores that you might put onto 
the wing. You can imagine that an 
advanced fighter aircraft would want 
to exceed the speed regimes beyond 
the flutter boundary of the air- 
craft. In this particular case, we 
know flutter mode control works. We 
know we can provide feedback if we 
know what the plant is, if we know 
what the wings dynamics are. Our 
goal was to identify instantenous 
flutter changes after releasing the 
store without getting knowledge, 
say, from the weapons computer, that 
the aircraft had actually dropped 
the store. I, for one, and others 
have said "Well, why do you not just 
share the information with the 
weapons computer and forget about 
trying to change this thing adap- 
tively?" Well, the problem is the 
Air Force would like to look at such 
an exhaustive number of stores that 
they want to see if you can do it 
adaptively. This was probably the 
single, most difficult adaptive con- 
trol problem we ever tackled. And 
we recently had some success in the 
Langley wind tunnel at dropping a 
couple of stores off of a wing 


model . The methods we used were 
least squares detection and maximum 
likelihood identification. I will 
point out now that the control law 
we used in combination with this was 
again a simple, highly limited type 
of control law that did not allow us 
to get into more difficulties. 

So there are two messages here 
for our group. One is that we can 
look at parameter identification for 
surface effectiveness, or perhaps 
for some other changes that could 
occur in the aircraft. It appears 
to us, from our fighter experience, 
that the RMS levels that we need for 
test signals would be low enough to 
attempt this. The wing/store 
results really surprised us. We did 
not think that we could do it. As a 
matter of fact, I am still skepti- 
cal that we can make instantaneous 
parameter identification. In one 
particular case we tried, when we 
dropped the store, the wing went 
from a stable flutter condition to 
an unstable one. We had to detect, 
isolate, and reconfigure in less 
than two seconds, and we were able 
to do that. This is a very high- 
risk technique though, but there is 
enough success here, I think, to 
warrant future looks at this type of 
technique for a more global role of 
control reconfiguration. 
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A CONCEPT FOR FCS 
RECONFIGURATION* 


* Proposal Submitted to OARPA 


So, I would like to suggest, 
in finishing, that it is a critical 
thing to put all this together into 
a concept of flight control system 
reconfiguration. Here again I am 
alluding to the military. This 


next viewgraph shows a proposal 
that we have submitted to DARPA 
recently. I am just going to 
allude to one diagram that we have 
in this. 
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In this particular case, we are 
showing our design approach for sur- 
faces where we design primary con- 
trol laws. One thing we would like 
to look at is specifying these con- 
trol commands in terms of forces, 
moments, and rates, instead of 
actual surface positions. This is 
desirable because at any moment in 
time we may not know what surfaces 
are available to implement those 
control laws. 


Now, for a given set of sur- 
faces, we can have some notion of 
detecting and isolating failures. 
We would like to optimize those 
remaining surfaces to maximize a 
stated design goal, to maximize the 
stability margins. 

I will not go into the sensors. 
That is, basically, some lower risk 
technology that a lot of people, 
like Honeywell and Draper, have 
already worked on. 
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This, therefore, is a concep- 
tual block diagram to implement such 
a control law. If we can construct 
a control law that commands forces 
and moments for primary performance, 
go into a block where we insert air 
data, the status of the sensors, 
etc., and go into a surface alloca- 
tion algorithm based on knowing 


which surfaces are available, one 
has the structure to look at imple- 
menting the best possible set of 
performances that you have for the 
aircraft. In summary, I am sugges- 
ting a structure for one to look at 
before actually designing a control 
system. 
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RESTRUCTURABLE CONTROLS 
PROBLEM DEFINITION AND FUTURE RESEARCH 


David R. Downing 
The University of Kansas 
Lawrence, KS 66045 




The approach that I took in to define the problem and then try- 
putting the presentation together ing to identify some of the options 
was more along the lines of trying that we have for future research. 
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Restructurable Controls 


Objectives following a System Failure 

1. Stabilization for the current task 

2. Provide optimal handling qualities 

FOR ALL MISSION TASKS 

3. Assist pilot in selection future tasks 


One of the points which was 
just brought up, which I think is 
crucial in trying to define the 
problem, is what, in fact, do you 
want the reconf igurable control to 
do? There are really three levels 
that can be discussed. 

One is that immediately after 
the failure occurs you at least 
want to establish stabilization at 
that point. You want to provide 
that, but basically that really is 

f 

not enough. There are other mis- 
sion tasks that you want to accom- 
plish. For example, if you are in 
climb out, you are going to want to 
establish a stabilized climb out; 


then you are also going to want to 
go through a cruise condition and 
finally get back down and land. 
And these three conditions require 
very different things from your 
controller. They are different 
problems. 

Tom Cunningham pointed out 
that the handling qualities for 
these three missions are different 
enough that there are actually dif- 
ferent MIL specs that cover designs 
for these conditions. So, this 
means that you not only have to do 
the reconfiguration once, but you 
have to do it two or three times.. 
Also you may not want just to land 



but to actually go all the way to 
the end of the original objective. 

One of the interesting capabi- 
lities that you may want the system 
on board to have is to be smart 
enough so that, if you have had a 
failure and you automatically stabi- 
lize, the pilot can essentially 
query the computer and ask "can I 
change my airspeed by reducing it by 
50 knots?" or "Can I change into 
this particular configuration?" The 
computer should be able to evaluate 
the reconfiguration potential at 
that new condition and be able to 
warn him that it would be a 
dangerous condition. 

Again, with the DC-10, I think 


one of the problems the pilot had 
was that he slowed down for some 
reason or another. If he had main- 
tained his speed, he would not have 
had a problem. So a lot of times, 
even though you stabilize the situ- 
ation, and perhaps identify what 
the mission is or what the failure 
was, the pilot still may not know 
what his available options are. 
So either you have the computer 
present him with the things that he 
should do, or let him query the 
computer as to the different op- 
tions he can think of and have the 
computer provide him with the con- 
sequences. 
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Failure Classification 


I 


Failure 

Effect 

Corrective Action 

Sensor 

Loss OF FEEDBACK PATH(S) 

t Redesign of 
stabilization 

SYSTEM 

Actuator 

Loss of Control Effectiveness 

• Modify plant 
MODEL 

• Redesign stabili- 
zation SYSTEM 

Engine 

• Asymmetric Forces and FIoments 

s Trim Aircraft 

• Redesign stabili- 
zation SYSTEM 

Aerodynamic change (minor) 

Stabilization degraded 

• Use insensitive 

CONTROLLER DE- 
SIGNS 

Aerodynamic changes (major) 

s Trim State changed 
• Stabilization degraded 

• Trim Aircraft 

• Redesign stabili- 
zation SYSTEM 


This viewgraph lists various 
failures, the effects of these with 
regard to the controls, and the cor- 
rective action required. For com- 
pleteness, I also included the sen- 
sor failures even though that was 
not a part of the control ground 
rules. I have violated several of 
the ground rules in the assumptions 
provided so as to present a little 
bigger overview. 

The loss of sensors is like 
losing feedback paths and in doing 
that you have to be able to design 
a controller with a restricted num- 
ber of feedback paths. There is 
some theory available for designing 
limited state feedback controllers. 
It is unclear if this can be done 


in real time. 

The loss of control effective- 
ness or control power, if you lose 
an actuator, requires the redesign 
of the stabilization system. 

A different kind of problem 
occurs with engine failures or 
aerodynamic changes. This is the 
introduction of trim changes. 
As everybody has mentioned it, this 
is crucially important because 
quite often when you think about 
control design, you are dealing 
primarily with the perturbation 
controllers. Trim is an altogether 
different problem. And probably 
for many cases if you could re- 
establish a trim, the majority of 
the problem would be solved. 
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This viewgraph presents a block 
diagram to show, conceptually, the 
three pieces that we are talking 
about. Notice that you have got a 
stabilization system, a trim system, 
and some kind of plant identifica- 
tion. 

Given the fact that we know 
what the mission task is, and if you 
are required to reconfigure, you 
have to let the computer know the 
mission.. Also, after the failure 


has occurred some kind of identifi- 
cation of the plant is required. I 
purposely used plant rather than 
parameter because, here again, we 
are not talking about just the per- 
turbation models and the stability 
derivatives. Finally, I have expli- 
citly shown a trim system. 

Although the three pieces are 
shown separately they could be me- 
chanized in one computer. 
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Fundamental Issues and Options 

• 

Airframe Design 
Existing Design 
Future Design 

■ 

Failure Type 
Predictable 
Unpredictable 

• 

Control System Type 
Automatic 

Manual (Pilot in the Loop) 

0 

Post Failure Mission 
Safe Landing Only 
Complete prefailure mission 


To design such a system there 
are several fundamental issues that 
have to be decided. These include 


the airframe design, the failure 
type, the control system type, and 
the post-failure mission. 
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AiimuM Ditiai 

• RtmariT ra Exiitim Airciatt 

• 

LIHITD RllTmiCTUMBILm 

Littu uufw. couruM 

iMFncTIVf ALTUMTt CONTIIOLt 

• Futum Duiau 

DHIIN of CoMFimUTlOH NITH •fCMtniUCTJIIILITY lOMJ 
AoOITIOIIAL CSMTMN. iUOFACII 
PWFOIIFUL CMliCaUFLIM 
ImuuTioa OF fiopuliion and fliwt contmli 


Now I want just to talk briefly 
about each one of these starting 
with the aircraft design. There are 
two categories within this issue. 

One is the retrofit of existing 
aircraft. There is really a limit 
to what we can do as control de- 
signers because, first of all, there 
is little useful coupling between 
the various variables. In fact, if 
you want to design an aircraft, you 
would like to get rid of all the 
cross -coupl ing effects. If we have 
done a fairly good job of that aero- 
dynamical ly, and now we want to go 
back and use coupling for reconfi- 
guration, we do not really have a 
very good opportunity. Also the 
alternate uses of control surfaces 
in existing configurations are not 
very effective. One of the examples 
that I am aware of using alternate 
controls is that to make perturba- 
tions in the roll angle, you can 
apply rudder which creates a side- 
slip, which then creates a roll 
rate. Thus you can use rudder to 


adjust the roll angle if you are 
dealing with small angles. So, 
although we actually have some coup- 
ling for current aircraft, it is 
really not very effective and could 
not be used to make large changes. 

For future designs, we have a 
chance to do something very dif- 
ferent. One of the things that we, 
as control engineers, should almost 
demand is the opportunity to be in- 
volved in the configuration design. 
Usually a control designer is given 
an aircraft and told, make this ve- 
hicle work. We cannot really afford 
to do this anymore. The design of 
the airframe and the control system 
is an integrated function. It is 
really something that is required 
and offers a lot of opportunity. 
For example, we have talked about 
the addition of control surfaces. 
Also you could build in purposeful 
cross-coupling, so that you could 
turn a rudder into a more effective 
roll-rate device. The coupling 
during nonf ailed flight could be 
handled by the vehicle's SAS. 
Therefore, one could take out all 
the unwanted coupling in .a nonf ailed 
condition and yet provide the coup- 
ling capability when you did have a 
failure. Another example is using 
the propulsion system as another 
control device. 


88 




FAILURE TYPE 


• Predictable Failures 

Multiple Precomputed Designs 
Failure Identification 

Controller Design Selection and Implementation 

I Unpredictable Failures 

Failure Identification 

System Identification 

Controller Redesign and Implementation 


In terms of the failure types, 
you have to consider both predic- 
table and unpredictable failures. 

Regarding predictable failures, 
there is an awful lot that we can 
do. For example, multiple, pre- 
computed designs provide a way of 
handling these failures. It would 
seem that you could actually handle 
a great deal of the existing prob- 
lems just by worrying about pre- 
dictable failures. If unpredictable 
failures imply that no a priori 


analysis or design can be done, then 
you have a much more difficult 
situation. 

For the unpredictable cases, 
you basically have to go through 
the failure detection, the system 
for plant identification, and then 
actually perform an inflight re- 
design. All these things have to 
be done in the blink of an eye. 
And, right now, I have my doubts 
whether that is something that we 
will see very shortly. 
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Control System Type 


• Automatic 

• Manual 

Good handling qualities required for all mission tasks 
Pilot - controller communication essential 
Mission task selected by pilot 


Another of the fundamental 
issues is whether this is going to 
be an automatic or a manual system* 
I think the only way the auto- 
matic mode is going to be accep- 
table, especially for commercial 
airlines, is at the instant of 
failure. When a failure occurs, you 
are going to want the system to 
automatically take over and stabi- 
lize the aircraft. This is, how- 
ever, all you are going to want the 
system to do. You are going to want 
it to reconfigure itself, but only 
at the request or with the inter- 
action of the pilot. Pilots are not 
going to let you go beyond that. 
You know, this idea of you getting 


up in the air and having a failure, 
and the computer says, "okay, you 
can go get a cup of coffee now, I 
will take it down and land it," is 
not something that is very feasible. 
It may be something that is techni- 
cally possible to do, but it is 
something that just would not be 
acceptable to the pilot. Therefore, 
if there is going to be a manual 
system and the pilot is going to 
have to fly this reconfigured ve- 
hicle, you have got to be very care- 
ful about providing the best hand- 
ling qualities within the remaining 
capability. This requires careful 
consideration of the interaction 
between the pilot and the system. 


90 



Post Failure Mission 


• Safe Landing 

• Complete "Original" Mission 
§ Get The Pilot Out (Military) 


We also talked about the post- 
failure mission as being one of two 
extremes. One extreme is that I 

just find a field somewhere, hope- 
fully it has a runway on it, and 
all I really want to do is land 
safely. The other extreme is the 
requirement to complete the origi- 
nal mission or some alternate mis- 


sion. The post-failure mission 
will depend strongly on the appli- 
cation. A commercial airliner 
would most likely require only a 
safe landing whereas a military 
mission might put a high priority 
on continuation with the original 
mi ssion. 
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Assessment of Status 


• Real Time PI 

• Real Time Controller Design 

• Design for Predictable Failures 

• Design FOR Minor Aerodynamic 

CHANGES 

• Design for Major Aerodynamic 

CHANGES 


BEYOND 1990 's 
BEYOND 1990 'S 
FEASIBLE BY 1990 
FEASIBLE BY 1990 

Design problem undefined 


I tried to make a rough guess 
as to where we are in certain tech- 
nology areas. I broke it down into 
two time intervals, the 1990 's or 
beyond. This is not terribly dif- 
ferent than what Mike Athans said 
earlier. His, of course, was a lot 
more detailed. But, one of the 
things that we can agree on is that 
unpredictable failures which re- 
quire real-time parameter identifi- 
cation or plant identification and 
real-time controller design are 
still very far in the future. 
If you drop back to predictable 
failures or minor aerodynamic 
changes, solutions should be very 
feasible in the next eight years. 
Although we can solve this class of 
problems, research is required to 
demonstrate the feasibility of such 


a system. 

A problem which requires ex- 
tensive research is reconfiguration 
following major aerodynamic 

changes. This class of failures 
involves major trim changes and 
important nonlinear effects. 

Little has been done to assess the 
size of reasonable failures of this 
type. One way to help define this 
problem is to investigate the bat- 
tle damage for military operations. 
As Tom mentioned there are all 
kinds of pictures of B29's and 
B17's with their tails virtually 
shot off that somehow limped back. 
Therefore, the first order of busi- 
ness is to collect data to bound 
the problem. Then we could have a 
better idea of how long it is going 
to take to solve it. 
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Topics fm Future Research 


• Measure of aircraft confiouratioh restructurable potential 

• Airframe configuration and flight control systems integration 
DESIGN procedures 

G Plant identification techniques 

G Controller design techniques 

• Restructurable control concept verification tools 


Now, in terms of the new 
research areas that I see, I would 
first like to tell you about the 
concept of "noble goals." It turns 
out that model reference adaptive 
control at one time was one of my 
"noble goals." It is just an ab- 
solutely super idea, if they could 
ever make it work. I also had been 
through the problem of trying to 
make it work in very simple cases, 
and gave up on that about four or 
five years ago. 

One of the things that would be 
another "noble goal" is if we could 
actually have some measure of the 
reconfigurability for a particular 
configuration. Maybe this is some 
kind of a wild dream again, but it 
is in fact something that we should 
attack. There are really two rea- 
sons for that. One is that if we 
are given a configuration, it would 
be nice to be able to determine its 
potential for reconfiguring before 
we actually get off and start de- 


signing controllers for it. 

The second thing, in terms of 
the utility of such a metric, is as 
a spec for the design of the air- 
plane. In other words, you not 
only have a performance spec, you 
have a mission spec, and you also 
have a reconfigurability spec. 
That would be kind of interesting 
since that would allow the control 
designer to get into the loop 
earlier in terms of configuration 
design. This really gets back to 
the idea that the airframe, recon- 
figuration, and the flight controls 
design really have to be done 
together. We cannot afford to do 
things separately or try to patch 
up what the aerodyn ami cists have 
done to us inadvertently. 

There are three other areas 
that we have yet to address: plant 

identification techniques, control- 
ler design, and the restructurable 
control concept verification tools. 




Plant Identification 


• Efficient methods of identifying "full* model 

• Simplified methods for real time identification 


In the area plant identifica- 
tion I would like to discuss two 
areas. The first is real-time 
parameter identification using sim- 
plified methods that can be imple- 
mented in an onboard computer. 
One way to think about parameter 
identification is just as a very 
sophisticated curve-fitting tech- 
nique. The programs used have been 
refined to give estimates of the 
parameters for reasonable data 
inputs. However, there is a lot of 
extra degrees of freedom that allow 
us to get multiple solutions from 
the same data. So the problem then 
is not to get a solution, but to 
get the right solution, i.e., the 
accurate model of the aircraft. 

I fear that inflight real-time 
parameter identification might be 
another of the "noble goals." 

The other main area involves 
only the predictable failures. 
For this case we will want to do 
parameter identification for all 
the different conf igurations. This 


may be done either theoretically, 
experimentally, or by a combination 
of the two. For this we have the 
curse of dimensionality compounded 
by the fact that in addition to the 
standard stability derivatives and 
the control effectiveness, you are 
also going to want to identify coup- 
ling terms that are usually ignored. 
Also, you are going to want to iden- 
tify coupling through the control 
power terms which we normally ig- 
nore. For example, we normally do 
not think about the pitching moment 
due to the rudder, but now that may 
in fact be an important factor. 
Finally, we want to develop models 
of the airplane with failed compo- 
nents, e.g., asymmetric trim condi- 
tions. Therefore, one is presented 
with a multitude of different flight 
conditions, and configurations, that 
require models. If flight tests are 
required, this would be extremely 
expensive. Research is therefore 
required to develop efficient model 
determination techniques. 
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Controller Design Techniques 


• Emergency Autotrim System Designs 

• Simplified “Optimal" Control Design Procedures 

• Efficient Limited State Feedback 

• Design Procedures for Nonlinear Systems 


There are several categories of 
control design procedures that are 
applicable to the restructurable 
situation. One of the major ideas 
is an emergency autotrim system that 
is at the heart of the problem. If 
you can retrim the aircraft after a 
failure, the pilot could fly the 
aircraft and diagnose his situation. 
This implies a very high authority, 
fast responding system which may not 
be acceptable to the pilots. This 
would be. different from standard 
trim systems which are very slow 
responding and of limited authority. 
To design an autotrim system we must 
assure that we have no false alarms. 
All you need is one false alarm and 
the system would never get turned on 
again. 

We have talked about optimal 
control design procedures and sim- 
plifying those so they can be done 


on line. One that would be appli- 
cable is limited state feedback. 
This technique is now used to design 
control systems where you want to 
limit the number of either sensors 
or states. For example, you want to 
actually reconfigure or redesign in 
a limited state sense where you 
basically now eliminate the feedback 
loop associated with the failed 
sensor. This procedure requires a 
reasonable amount of time on a main- 
frame computer at present so that 
more efficient design algorithms are 
required. 

The last of the design tech- 
niques is an attempt to attack the 
nonlinear problem directly. Di- 
rectly attacking the nonlinear prob- 
lem is another of the "noble goals." 
This does not seem feasible in the 
near future. 




Restructurable Control Concept Validation Tools 


• Theoretical Predictions 

• Batch Simulation 

• Real Time Simulation 

• Flight Test 

Model Tests 
Full Scale 


If we are successful at deve- 
loping restructurable techniques, 
the next main issue is their veri- 
fication. How well we do this will 
have a big impact on their ultimate 
acceptance. To do this, we have 
theoretical predictions, batch and 


real-time simulations, and ulti- 
mately flight verification. I be- 
lieve that the flight verification 
of these techniques is essential. 
I also believe that proof of con- 
cept demonstration can be done 
using research aircraft. 
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Advances Control Concept Test Vehicle 




• Multiple independent computer controueo 
control surfaces 

• Dedicate cable driven control for safety 

PILOT 

• Instrumentation package 

• General purpose computation system 


One of the concepts that we 
have at the University of Kansas 
which would allow us to do that in 
a efficient way is pictured on the 
viewgraph. The concept is to take 
the existing control surfaces and 
split them. You would essentially 
then have many surfaces, each of 
which is independently drivable or 
controllable by the computer. 
One set of surfaces would be con- 


nected to the cable system to re- 
tain an independent safety pilot 
system for the airplane. The re- 
maining surfaces could be used in 
two ways . 

One way is that you can simu- 
late failures by using some of the 
control surfaces as the failure 
mode generator to generate asymme- 
tric loads or just loads in the 
failed actuator. The remaining 
surfaces could then be used for re- 
configuration. This aircraft would 
allow the verification of the 
general concepts worked. 

Another idea that would be very 
desirable would be to pick the size 
so that all the surfaces can be 
driven by the same type and size 
actuator. One of the problems that 
exists when there are multiple sur- 
faces on an airplane is the fact 
that each surface requires its own 
kind of actuator. This would cause 
a problem with the military because 
of the cost of maintaining equipment 
with a large number of dissimilar 
components. I do not think that it 
is necessary to use different 
servos. You can be clever in the 

way you size the controllers and 
position them so that you can use a 
common servo or a common actuator. 
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Conclusions and Recommendations 


• Major Improvement in Safety through a new Controller Design Philosophy 
Feasible 

• Two Phase Program Desirable 

Near Term - Predictable Failures 
Far Term - Unpredictable Failures 

• Well-Defined Problem and Program Goals Essential 

• Integration of Aircraft Configuration and Controller Design offers 
Maximum Impact 

• "Real World" verification of Concepts Essential 


In terms of closing, these are 
my conclusions and recommendations. 
It looks like we really do have a 
concept that can be attacked and has 
the potential to provide a major im- 
provement in safety. This concept 
can be researched through a program 
formulated from this workshop or 
other related areas. We really 
should not ignore investigations for 
possible near-term solutions, e.g., 
solutions to predictable failures. 

I think there is a lot to be gained 
by collecting the available tech- 
nology and actually showing that it 
works for predictable failures. At 
the same time, we should look at 
far-term concepts by investigating 
some of the basic theories that are 
really going to be needed for the 
concept of unpredictable failures 


and the more difficult problems, 
e.g., large aerodynamic changes. 
The real key to it all is the fact 
that whatever report comes out of 
the workshop should have a very well 
defined problem. The goal of the 
workshop is thus to try to identify 
the problem, what goals to set for a 
program of research, and how far to 
scope the research. 

Finally, I would like to 
stress two points. First the inte- 
gration of the configuration and 
the controller really offers the 
maximum impact. And second, I be- 
lieve very strongly that you are 
going to have to do some real world 
verification of the concepts if you 
really want it to be accepted by 
the industry. 
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EXPERIMENTAL EXPERIENCE AT CALSPAN 


Edmund G. Rynaski 
CALSPAN 

Buffalo. NY 14240 


Introductory Remarks 

I want to share with you my 
ideas on the subject of restruc- 
turable controls. As an introduc- 
tion, I would like to relate the 
experience we had with one of our 
aircraft, a T33, which I think 


vividly illustrates the possibili- 
ties that exist today for restruc- 
turing the control system of an 
aircraft. 

During a research flight in 
our T33, the aircraft developed a 
severe wing flutter problem. For- 



tunately the aircraft was protected 
with explosive bolts, so that with- 
in a few milliseconds the explosive 
bolts sensed the flutter and blew 
off both wingtip tanks. As a 
result, damage was incurred by the 
outer third of the starboard wing 
(which essentially disintegrated) 
including half of the aileron. 
Also, the port wing warped con- 
siderably. Nevertheless, the pilot 
was able to bring it in without 
flaps at approximately 200 knots. 
Therefore, this was a survivable 
type of a sudden, restructed air- 
craft. We had not only restruc- 
tured controls because we had half 
of the starboard aileron, but we 
also had a restructured aircraft 
because we lost about a third of 
the wing. This type of experience 
has led us to consider this type of 
problem much more seriously than we 
had in the past. The Air Force has 


flown this aircraft very success- 
fully for many thousands of flight 
hours since 1955 using a fly-by- 
wire with feedback, analog control 
system. The Air Force is presently 
in the process of replacing this 
aircraft with an aircraft in which 
they want considerably more control 
versatility, in terms of having 
control over all six degrees of 
freedom of motion and maybe more as 
well. The three leading candidate 
airplanes are the F-5, F-18, and 

F-16. Because we are talking about 
3 or 4 years from now as far as 
cutting metal is concerned, we have 
an opportunity at this stage of the 
'game to look at, consider, and to 
study the restructurable controls 
problem so that an aircraft can be 
available or can have the versa- 
tility required to do the type of 
research that we will be discussing 
this afternoon. 
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PARTIAL LIST OF CONTROLLERS 


Nahe 

Primary Function 

Secondary Effects 

Traditional 

- Elevator 

PITCHIN6 MOMENT 

Z force 

- Aileron 

ROLLINS MOMENT 

— 

- Rudder 

YANIHS MOMENT 

Y FORCE 

More Recent 

- Servo -mROTTLE 

X FORCE (Z FORCE) 

PITCHINS MOMENT 

- Direct lift flars 

Z FORCE 

PITCNINS MOMENT 

- Collective ailerons 

- Cahnard surfaces 

Z FORCE 

PITCHINS MOMENT 

HORIZONTAL 

PITCHIN6 MOMENT 
ROLLINS MOMENT 

Z FORCE 


Z FORCE 

PITCHINS MOMENT 

VERTICAL 

y AM INC MOMENT 

Y FORCE 


Y FORCE 

YANINS MOMENT 

- Spoilers 

ROLLINS MOMENT 
Z FORCE 


- Differential Throttle 

YANINS MOMENT 

PITCHINS MOMENT 

- Differential elevators 

ROLLINS MMENT 


- Speed brakes/ split 

RUDDER 

X FORCE 


- Leadins edse slats 

Z FORCE 


Most Recent 

- Thrust vectorihs 

PITCH, YANINS MOMENTS 

X, Y, Z FORCE 

- Inlet 

YANINS MOMENTS 



With that introduction, let us 
get on to a more mundane type of 
discussion which is almost acade- 
mic. We start out with the tra- 
ditional type of surfaces — the ele- 
vator, the aileron, and ruddei — and 
list the primary function of each — 
which is pitching moment, rolling 
moment, and yawing moment, respec- 


tively. But each one of these con- 
trollers has secondary effects. 
The elevator, of course, produces a 
vertical force as well as a pitch- 
ing moment because it is a lifting 
surface. The rudder produces not 
only yawing moment but a Y-force, 
or lateral force, as well. 
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Then we go on to more recent 
types of control devices that have 
been implemented in aircraft. 
The servo throttle produces an 
X-force or a Z-force, or both, and 
also a pitching moment, depending 
upon how the engines are located 
and mounted on the airplane. Now- 
adays the throttle, even manually, 
is used quite often. For instance 
in the carrier landing case, one 
thinks of the elevator and the 
stick as the primary controllers as 
far as pitching moment is con- 
cerned. Yet on a carrier landing, 
a pilot may use the elevator to 
control his angle of attack or 
velocity, and he may use his throt- 
tle to control his flight path 
angle. This, in a sense, is a 
switch in the conventional role of 
controllers and how the pilots use 
them. Therefore, even today, there 
is more than one primary task for 
several of the controllers that are 
available on aircraft. The direct 
lift flaps produce primarily a 
Z-force, or direct lift force, but 
can also produce a pitching moment, 
depending, of course, on their 
location with respect to the CG of 
the aircraft. Collectively opera- 
ted ailerons are essentially the 
same thing as the direct lift 
flaps, but if you have swept-back 


wings and the ailerons are located 
farther outboard, then you could 
have more pitching moment than with 
the inboard direct lift flap. 
The more recent aircraft have can- 
nard surfaces, which are horizontal 
~or vertical, and produce pitching 
moment, rolling moment, and Z- 
force. The secondary effects could 
be Z-force but, depending on how 
they are mounted and how they are 
designed, any one of these can be 
the primary and the other the 
secondary function, or you do not 
even have to define which is pri- 
mary and which is secondary. Ver- 
tical cannard surfaces can produce 
a yawing moment or a Y-force, and 
then the secondary function is 
either a Y-force or a yawing 
moment, depending entirely on where 
they are located on the aircraft. 
Therefore, the location of the sur- 
faces on the aircraft is just as 
important as what kind of surfaces 
they are. This is also true for 
sensors. The sensors have two pri- 
mary functions and there are at 
least two primary design considera- 
tions — what they sense and where 
they sense it on the aircraft, both 
of which are very important. 
And there is a direct analogy be- 
tween this and the surfaces that 
can be put on aircraft as well. 
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Then there are spoilers which pro- 
duce rolling moment and Z-force be- 
cause they destroy lift. There are 
differential throttles for yawing 
moments and pitching moments, 
depending again on where the thrust 
acts with respect to the coordinates 
of the aircraft, and there are also 
differential elevators. Speed 
brakes and split rudder are for X- 
force control. 

Most recent and probably one of 
the most useful devices is thrust 
vectoring, or an equivalent. This 
is because probably the most diffi- 
cult thing to compensate for, in 
terms of restructured control, is 
the primary pitching moment control 
of the elevator on an aircraft. 


Therefore, thrust vectoring, which 
can produce pitching and yawing 
moments and X-, Y-, and Z- forces, 
will be one of the most versatile 
controls that can be implemented on 
an aircraft. Then, of course, there 
is the inlet which produces yawing 
moments and a lot of other kinds of 
effects as well. 

All these different control de- 
vices, controlling vectors, if you 
Rant to call them that, exist now on 
aircraft. And this is only a par- 
tial list. By exploiting the secon- 
dary effects of these control de- 
vices, restructuring to maintain 
basic pitch and roll control seems 
almost always possible. 
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Multiple Means of Generating 
Forcesj Moments Available 


• Little thought given to reconfiguration 


• Probable that host nem configurations can 

BE FLOWN with ALTERNATE EXISTING CONTROLS 

- AFTI-16 

- AFTI-m 

X-29 (FORWARD SWEPT WING) 

Shuttle 

- F-13 

• Vehicles not configured for redundancy of 
CONTROLS 


• Aircraft control systems not designed to 

CONSIDER MULTIPLE USE OF EXISTING CONTROLS 


i.E. Roll aircraft use rudder for 

PITCH CONTROL 


As far as the design of the 
aircraft is concerned, to the best 
of my knowledge, essentially little 
thought is given to restructure in 
the design of these aircraft con- 
trols. And it is probable that 
most new configuration aircraft can 
be flown with alternate existing 


controls. Some examples of such 
aircraft are the AFTI-16, the 
AFTI-111, the X-29, the Shuttle, 
although this is less likely, and 
the F-18 that have a redundant set 
of controls. These aircraft have 
not a redundant, but a superfluous 
set of controls, and to the best of 
my knowledge, except for the F-16's 
CCV program, the restructurable 

control potential was not really 
considered. Thus this is virgin 
territory that we are talking 
about. It is not only a virgin 

territory, but a territory that is 
expanding and is more likely to be 
successful than many others I have 
heard of in the recent past. 

Today's aircraft are not configured 
for redundancy of controls. Also, 
aircraft control systems are not 
designed to consider multiple use 
of existing controls. For in- 
stance, if we consider the L-1011 
that got caught with its elevator 
hung up, the pilot could have pro- 
vided pitching moment by rolling 

the aircraft ninety degrees and 
then using the rudder, taking ad- 
vantage of the Euler angle type of 
situation in which airplanes fly. 
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CONTROL PC^ER REQUIREMENTS 

• Trim 

• Maneuvering 

• Maintain stabilitvj enhance flying qualities 

• Special purposes 

DEPARTURE^ SPIN RECOVERY 
- ROTATION ON TAKE-OFF 

FUTURE AIRCRAFT DESIGNED FOR 

• Maximum thrust 

• Minimum drag 

• Adequate lift 

t No INHERENT STABILITY REQUIREMENTS 

OPTIMUM CONFIGURATION ? 

Thrust vectored frisbie 


Let us now consider control 
power requi rements. Usually, con- 
trol surfaces are sized for several 
reasons. Fundamentally there is 
trim, which is of prime importance. 
However, one must also have addi- 
tional control power to maneuver the 
airplane, and that is of consi- 
derable interest to the Air Force. 
You also need some control power for 
feedback, if you are going to use 
it, for the purposes of maintaining 
stability and enhancing flying 
qualities. And let us face it, 
there are only two reasons why you 
use feedback on an aircraft: one is 

to maintain stability and the other 


is to enhance the flying qualities. 
Flying qualities are everything. 
They define the criteria of why you 
use flight control systems at all. 
So, if you do not have flying quali- 
ties as your criteria, you could be 
in big trouble. Flying qualities 
are defined by MIL-F-8785 B,C, which 
represent the only experimentally 
verified data essentially in exis- 
tence today. You have spinoff, or 
alternate criteria, such as C*, 
which were generated analytically, 
but were never really experimentally 
verified in flight. 

Future aircraft are going to 
be designed for maximum thrust, 
'minimum drag, adequate lift, and no 
inherent stability requirements. 
Alright, what does that amount to? 
The optimum configuration of future 
aircraft amounts to a thrust vec- 
tored Frisbie, because a Frisbie 
has the maximum L/D that you could 
possibly ask for — a flying saucer. 
As long as you have the lift, the 
thrust, and lots of control power, 
you do not care what the airplane 
really looks like geometrical ly. 
So all the science fiction of the 
flying saucer is not that bad. 
From a flight-control point of 
view that is the optimum alterna- 
tive, but obviously it cannot be 
achieved. 
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NEW AIRCRAFT DESIGN VS EXISTING CONFIGURATION 

A. Existing Aircraft 


• Systematic examination 

of loss of controls 

- Dfterhine if: 


TRIM 

POSSIBLE OR NOT 7 

MANEUVERABILITY 

MISSION ACHIEVEMENT - DECREASED ) 

FLYING QUALITIES 

FEEDBACK POSSIBLE TO YIELD 


FLEXIBLE AIRCRAFT? 


l.E. CONTROLLABILITY 

~ Is FAILURE DETECTABLE? 

- Is FAILURE TRANSIENT TOLERABLE? 

~ Sudden change in flying qualities tolerable? 

' B. New Aircraft Design 


• nuLTIPLE OR MULTI FUE-SEONENT CONTROLS 

t Redundant sensors/ computers^ servos 

• Redundant electrical^ 

HYDRAULIC SOURCES 

t Dissimilar redundancy 


F-18 


Digital system 


Analog system 

Control of horizontal tail 

Direct hecnanical 

(Collective and Differential) 


There are two ways we can look 
at this particular program: one has 
to do with existing aircraft and the 
other has to do with new aircraft 
design. I think that they represent 
two important, but significantly 
different, research objectives that 
a restructurable controls program 
might take. 

For existing aircraft, one ap- 
proach would be to take an existing 
aircraft, such as an F-18 or the 
AFTI-16, and conduct a systematic 
examination of the loss of the dif- 
ferent controls. By systematic I 
mean examining the different ways in 
which you can lose a control. For 
example, it could break off, it 


could hang up, it could go maximum 
deflection, or it could tear. And 
then determine if it is possible to 
trim throughout; and this, of 
course, is a function of flight 
envelope, or flight condition. How 
about maneuverability? Can you 
achieve the mission with the excess 
control power you have available 
above and beyond trim, or not? And 
then of course, what are the flying 
qualities? Because for the Air 
Force, if it is an F-16 or an un- 
stable configuration, you have got 
to provide stability for this 
aircraft. So you look at some 
things like controllability of the 
vehicle. That is, controllability, 
not only in the classic sense that 
Mike Athans referred to, but also 
in terms of trim and control power 
left for maneuver--the static as 
well as the dynamic controllability 
of the aircraft. And then, of 
course, you have to ask some addi- 
tional questions. Is the failure 
detectable? It may not be. If you 
have no failure transients asso- 
ciated with a failure, which is 
possible if you are flying in trim 
then you may not detect it unless, 
of course, you have a sensor on the 
surface. That may be, but if the 
surface does not move, then you 
have no way of detecting a failure. 


II II 
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But that might not be so bad. 
If you are in trim and you have a 
failure, then detecting it may 
serve no purpose at that particular 
time. On the other hand, if the 
failure occurs at other times in 
the flight range when you are out 
of trim, then you can have signifi- 
cant failure transients, particu- 
larly if the failure results from 
an unstable configuration, like the 
F-16, for instance. Another factor 
to be considered concerns the sud- 
den change in flying qualities. 
Of course, first of all you have to 
ask the question, can you maintain 
the same flying qualities with an 
alternate control surface? Perhaps 
you can; perhaps you cannot. 
If you can, you may have so little 
control power left over that you 
cannot maneuver. So you may not 
want to maintain the same flying 
qualities before and after the 
failure. 

In the new aircraft design one 
has to consider such things as mul- 
tiple, or multiple-segment con- 
trols; that is, the elevator, rud- 


der, and aileron divided into 
several segments. In addition, one 
has to consider redundant sensors 
and redundant electrical and hy- 
draulic sources. For example, the 
F-16 has an electrical power system 
which is not redundant but triple 
string. In other words, you have 
to have essentially three failures 
occurring before you lose all elec- 
trical power. An example of dis- 
similar redundancy is the F-18, 
which has a digital control system, 
an analog system, and a backup 
direct mechanical system. And the 
mechanical system, I understand, is 
to be removed after awhile when 
they determine that reliability is 
satisfactory with the digital and 
analog systems. But as far as 
redundancy applied to control sys- 
tems is concerned, the dissimilar 
redundancy is more important than 
the similar redundancy of, say, the 
F-16. Now there is a quad-analog 
type of feedback system where you 
could have a failure that commonly 
affects each of the feedback 
paths. 
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CRITICAL TECHNOLOGY AREAS 


• Failure Detection/Decision Theory 

- Types of failures 

SURFACE JAHMEO 
SURFACE ZEROED (F>15) 

SURFACE HISSING 

COCKPIT CONTROLLER (COMMAND LINK FAILURE) 

- False Alarms 


• Flying Qualities 

- WlNIMUH FLYABIUTY 

- Effect of sudden changes in flying qualities 

• Controllability/Observability 

- Good definitions of relative controllability/ 

OBSERVABILITY REQUIRED 


• Adaptive Control - Parameter ID 

• fVjLTI VARIABLE CONTROL THEORY 

- Controllability/observability enhancement 

- Failure transient minimization 

- Stability guarantee - controller failure - 

MULTIVARIABLE SYSTEMS 

- Minimum interacting (coupling) 

- Maximum interacting 

- Transmission zeros and zeros of individual transfer 

FUNCTIONS 


Critical technology areas in- 
volve failure detection and decision 
theory. We have to consider several 
different types of failures, of 
course. We cannot just sav a sur- 
face failed. That does not really 
mean anything to a real airplane. 
The surface can be jammed. Alterna- 
tively, the surface can be zeroed 
like in the F-16 where it is spring- 
loaded, and in case of a failure of 


the flight control system, that sur- 
face is just zeroed or taken back to 
some original fixed position. What 
is done for this alternative is to 
select that position that represents 
trim position over the widest por- 
tion of the flight range, and that 
is the area in which the airplane 
flies most often, which is high sub- 
sonic. Nevertheless, it is still 
an unstable aircraft when you lose 
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your feedback. You have a step in- 
put due to the fact that the eleva- 
tor is returned to some original 
neutral position. The aircraft is 
highly unstable (pole in the right 
half plane, if you like) and they 
have had accidents which, in one 
case, produced a hard noseover and 
they lost the pilot. In another 
case they produced a positive G, 
a pulloff, where the pilot was 
able to eject. But the point is 
that, depending on where that sur- 
face is with respect to trim when 
the failure occurs, you could have 
either a pushover or a pulloff and 
these are very high magnitude 
maneuvers. That, I would consider, 
is a very significant type of con- 
trol system failure, although it 
does not involve a surface as such. 
There should still be some way to 
provide an emergency situation that 
would enable the pilot to get out 
of the airplane; even if he is over 
enemy territory, it is better to 
get out. Now, false alarms are 
really bad news. If you have a 
false alarm or if you make an im- 
proper decision once in these types 
of systems, then the pilots may 
never use the system again. This 
is, however, the psychology of 
pilots and they need only one 
really bad experience before, for 


all practical purposes, you are out 
of business. So you have to be 
very careful. 

As far as flying qualities are 
concerned, there are two areas, I 
think, that require more research, 
more investigation, and better 
definition: one is the minimum 

flyability as far as aircraft are 
concerned, not only with respect to 
experienced test pilots but also 
with respect to the line pilots, 
and the other is the effect of sud- 
den changes in flying qualities of 
the aircraft. It is what STI's 
McRuer would like to try to arrange: 
a graceful degradation of fly- 
ing qualities. But unfortunately 
the loss of the control surface is 
not going to be very graceful. 

Then, of course, there is the 
area of adaptive control and para- 
meter identification. And that is 
about as far as I want to discuss 
it. 

Now as far as some of the more 
theoretical aspects, you can con- 
sider multivariable control theory 
that was discussed this morning by 
Mike Athans. I think this contains 
a wealth of the type of information 
that is needed and defines many of 
the areas in which theoretical as 
well as applied research is re- 
quired, such as enhancement of con- 
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trol system design for improved 
observability and controllability, 
and for coupling different surfaces 
together. Mathematically speaking, 
controllability and observability 
are more or less absolute types of 
definitions. What is really needed 
is a better definition of relative 
controllability. That would be 
quite helpful. Failure transient 
minimi2ation--how do you minimize 
the transients that occur? You 
might produce a failure that would 
generate a transient more gradually 
rather than more suddenly. How do 
you guarantee stability in case of a 
controller failure when you are 
feeding back to many different con- 
trollers at the same time? This is 
a difficult problem as referred to 
in the work by Ackerman. There are 
considerable problems having to do 
with that because essentially when 
we go through multivariable control 
system designs, there are problems 
maintaining a minimum phase for some 


of the individual transfer func- 
tions. Now the zeros of individual 
transfer functions are often just as 
important to the pilot as the poles 
in the system, the eigenvalues. And 
they have to be watched very care- 
fully in the multivariable control 
system design to avoid the introduc- 
tion of closed loop, nonminimum 
phase responses. Then, also, there 
are good theoretical areas in mini- 
mum interacting or decoupling, and 
also in maximum interacting or coup- 
ling. Both of those areas are just 
as important with respect to each 
other, because they are obviously 
closely related and because the 
emphasis has been on minimum inter- 
acting types of systems. Much more 
research is required in how to get 
these systems to interact maximally. 
The design should be such, if possi- 
ble, that each controller adds to 
the total controllability of the 
system, rather than have controllers 
effectively oppose each other. 
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PARAflETCR IDENTIFICATION 


• CONTTML EFFECTIVENESS HOST IMPORTANT 


- A LOOP SAIN PARAMETER 

- Defines integrity of controller 

- Defines stability in statically unstable 

AIRCRAFT 


- For aircraft with lots of feedback, is almost 
ONLY parameter OF CRITICAL IMPORTANCE IN 
SENSITIVITY ANALYSIS 


- Sudden change in control effectiveness will 
produce abrupt acceleration change. Simple 
models may suffice 

I .£. p " p + 


Right after saying that I was 
not going to discuss parameter iden- 
tification, I have a viewgraph 
entitled "Parameter Identification." 

Obviously, what we are looking for 
in parameter identification is con- 
trol effectiveness. And also I 
might add control power, but control 
effectiveness is the most important. 
This is a loop-gain parameter in the 
general sense. It defines the inte- 
grity of the controller. It also 
defines stability in statically un- 
stable aircraft, as you have feed- 
back on stabilized aircraft. For 
aircraft with lots of feedback, it 


is almost the only parameter of 
crucial importance if sensitivity 
develops as an issue. That is not 
quite a true statement, obviously, 
but let us say that it is the domi- 
nant parameter. Sudden changes in 
control effectiveness will produce 
abrupt acceleration change. For 
that reason, simple models may suf- 
fice. For example, for the rolling 
degree of freedom, the equation 
given here may be enough for the 
purpose of trying to find the inte- 
grity of the controller. Or it may 
not be enough. But at least it is 
probably the place to start. 




TYPES OF FAILURE OR EMERGENCY FOR RECONFIGURATION 


1, AuTOfWTic Deicction ahs Reconfiguration 

• During take-off and landing 

- DC-10 ACCIDENT IN CHICAGO 

- Hind shear accidents at Kennedy, New Orleans 

t Aircraft with inherent instability 

- F-16 electrical failure 

2. Pilot Warning / Alert / Oftion 

t Situation likely non-disasterous 

- Severe clear air turbulence at altitude 

- Partial loss of surface 

B-52 Vertical Tail in TF 
T-33 Wing Flutter 


Failure essentially has to be 
defined. What do we mean by a 
failure? Failure can be a physical 
failure such as a loss of a sur- 
face. However, another type of 
failure, which I would like to in- 
troduce, is the failure caused by 
external disturbances that cannot 
be detected or even controlled by 
the pilot. 

We have two types of fail- 
ures that should be considered. 
One type includes failures that 


require automatic detection and 
restructure, as far as trimming the 
airplane is concerned, independent- 
ly of the pilot. Most of these can 
be defined during takeoff and land- 
ing, such as the one that caused 
the DC-10 accident in Chicago and 
windshear accidents at Kennedy, New 
Orleans, and other places. These 
are catastrophic failures where the 
pilot has very little, if any, time 
to react. First of all he has to 
recognize the problem and then he 
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has to react to the problem. There 
is no doubt, for instance, that 
wind shears can essentially be ac- 
commodated with an automatic con- 
trol system, if the control system 
is designed to recognize the shear 
and act accordingly to get the 
pilot to fly out of it. Obviously, 
because of the accidents, the pilot 
cannot always do it. Other failures 
in this category involve aircraft 
with inherent instabilities. In 
these aircraft, when a failure oc- 
curs very suddenly, the effect can 
be so castastrophic in terms of a 
maneuver that, in order to keep the 
pilot aware of what happened, some 
method of automatic trim should be 
requi red. 

Now, the other type of failures 
includes those in which we might 


consider just warning the pilot dr 
alerting him. These are essentially 
high altitude types of phenomena, 
such as severe clear air turbulence 
at high altitude. These are not 
disastrous, but still clear air tur- 
bulence can produce problems. It 
produced, for instance, the famous 
B52 vertical tail incident during 
terrain following. I do not know if 
you recall that, but they lost two- 
thirds of the vertical tail surface 
during terrain following due to tur- 
bulence. There may have been other 
things wrong. And there is also the 
problem of the T-33 wing flutter 
type of accident that we had and I 
referred to earlier. These are at 
least two categories of kinds of 
failure that one might consider 
doing something about. 
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Now, as a conclusion, we can 
consider what type of controller we 
might like--a universal type of 
controller, if we had an option on 
how to do it. One suggestion, or 
one thing I might put up to you, is 
a split aileron type of device. 
Because depending on where this 
device is located on the wing, you 
could control up to all six degrees 
of motion. In other words, the 

aileron is split so that it acts in 
a clamshell open-and-close mode as 
well as the deflection up-and-down 
mode. What will it give you? 
It can give you roll, of course, 
acting as conventional differential 
ailerons. It can give you direct 
lift acting directly, or pitch de- 
pending on where they are located. 
If they are located near the wing 
tip of a swept wing aircraft, then 
they can give you as much pitching 
moment as direct lift, or both. 
Or you can use the collective 


ailerons with the elevator to give 
you both pitching moment and direct 
lift forces. Operating in the 
clamshell mode, the open-and-close 
mode, you can get direct modulation 
of the X-force. Or if you operate 
the clamshells differentially, then 
you will get a yawing moment for 
the aircraft. And if you operate 
the split ailerons differentially in 
conjunction with the rudder, then 
you can get a direct side force on 
the aircraft. So depending upon how 
this particular type of device is 
configured and where it is located 
on the wing or wherever on the air- 
craft, you can have the possibiltiy 
of getting control forces and mo- 
ments along and about all three axes 
of the aircraft. So, I am saying 
that this is merely a simple example 
to show that there is a lot yet that 
can be done in terms of enhancing 
the controllability of aircraft for 
the purpose of restructuring. 


A REVIEW OF SYSTEM IDENTIFICATION METHODS 
APPLIED TO AIRCRAFT 
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Introductory Remarks 

The topic that I will address 
at this workshop is a review of 
available system identification 


methods that may be applied to ob- 
tain the model of an airplane based 
upon the flight test data. 



IDENTIFICATION 

(DEFINITION BY ZADEH) 


IDENTIFICATION IS THE DETERMINATION. ON THE BASIS 
OF INPUT AND OUTPUT . OF A SYSTEM WITHIN A SPECIFIED 
CLASS OF SYSTEMS . TO WHICH THE SYSTEM UNDER TEST 
IS EQUIVALENT. 


The definition of identifica- 
tion is based upon the Zadeh for- 
mulation. This formulation says 
that identification is the deter- 
mination, on the basis of input and 
output, of a system within a speci- 
fied class of systems, to which the 
system under test is equivalent. 


Basically, the definition 
means that for system identifica- 
tion one must have these three 
items: the input and output data, 

a specified class of systems, and 
finally some set of criteria which 
will tell how close the model is to 
the actual system under test. 
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BLOCK SCHEME OF AIRPLANE IDENTIFICATION 



The system identification is 
part of the overall study for ob- 
taining the model of an airplane 
from flight test data and this is 
an outline of the flow diagram of 
the process. 


First of all we start with 
some kind of a priori knowledge 
which is used twofold: first of 

all it is used in the design of an 
experiment, and then in the model 
structure determination. Basically 







what I mean by design of an ex- 
periment is just how to find what 
would be the best input for good 
excitation of the transient motion 
of an airplane. There are several 
approaches to this problem: either 

just a simple engineering judgment 
or some semi -empirical estimation 
of the inputs based on a selected 
criterion that you want to achieve; 
either the estimates with the 
lowest variance, or the estimates 
which give you the responses 
closest to the measurements, and so 
forth. After designing and execu- 
ting the experiment, you have a set 
of measured data, usually in terms 
of time histories of input and out- 
put variables. 

Then there is a so-called com- 
patibility check. The purpose of 
this is essentially to find what 
kind of bias errors are in your 
measured data, and, if there are 
any, how to remove them. Usually 
we are talking about the bias er- 
rors in terms of the constant off- 
sets or scale errors. In this box 
also, we might reconstruct some 
variables which may be missing from 
the measurements. For example, 
sometimes it might happen that we 


cannot measure the angle of attack. 
But, using the measurements of the 
angular velocities and accelera- 
tions, we can reconstruct the time 
history of the angle attack. 

After the compatibility check 
it can be assumed that the measured 
responses are essentially true 
values of these variables which are 
corrupted by the measurement noise, 
because all the possible bias 
errors have already been removed. 

The next step is indicated 
here in two blocks, i.e., the model 
structure determination, and para- 
meter and state estimation. 
In some techniques all these steps 
can be executed at the same time. 
If we know, or if we assume that 
the model structure is known, the 
identification task is reduced to 
parameter and state estimation. 

Finally, the last and probably 
the most difficult part of the 
whole procedure is the model veri- 
fication. We would like to have 
estimates of the parameters which 
do have physical values and we 
would also like the estimates of 
the model with good prediction 
capabi 1 ities. 
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METHODS FOR OFF-LINE AIRCRAFT IDENTIFICATION 


a) identification of a system with given structure 

t equation error method [LINEAR REGRESSION, ' 
LEAST SQUARES METHOD] 

• MAXIMUM LIKELIHOOD METHOD 
t OUTPUT ERROR METHOD 

• EXTENDED KALMAN FILTER - 

b) parametric identification of a system with 

UNKNOWN STRUCTURE 

• STEPWISE REGRESSION 


BATCH PROCESSING 


SEQUENTIAL PROCESSING 


I would like to talk very 
briefly about various techniques for 
parameter estimation. I mentioned 
one technique which can estimate the 
model structure based upon the 
flight test data, and all of these 
techniques shown in the next few 
viewgraphs are off-line techniques. 
Here is a very brief summary of 
these techniques. They are divided 
into two groups: identification of 

a system with a given structure and 
parametric identification of a sys- 
tem with an unknown structure. I 
will address only the former in this 
vi ewgraph. 

I 

The methods for identification 
of a system with given structure 
essentially estimate the parameters 
from the set of input and output 
data. The first group of these 
techniques are the so-called equa- 


tion error methods, or they are also 
known as linear regression or least 
square methods. The names tell you 
what kind of techniques these are. 
The second technique is the famous 
maximum likelihood method. The 
third technique is the output error 
method which can be considered as a 
simplified version of the maximum 
likelihood technique. And finally 
the fourth technique is the extended 
Kalman filter. The first three 
techniques are usually used in batch 
processing mode whereas the fourth 
one is a sequential method. 

The equation error methods 
provide the direct estimates of the 
parameters. The recursive tech*? 
niques start with some estimates 
and iterate to the final parameter 
estimates. 
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I will outline, very briefly, 
how these techniques work just using 
this simple flow diagram without any 
mathematics. For the equation error 
method, the airplane response is 
excited by input u. We measure the 
state variables and also the deriva- 
tives of the states, and we assume 
that only the measured data of these 
states are corrupted by measurement 
noise. All the information about u, 
X, and X is used for the 
parameter estimation, where the 
X (corrupted by noise) is 
called y and serves as the dependent 
variable in the regression equation, 
and X and u serve as the independent 


variables in the same equation. 

There are disadvantages with 
this technique. First you must know 
all these variables from the mea- 
surements. Secondly, according to 
the theory, the estimates are biased 
because in reality there is always 
some measurement noise in the input 
and state variables. 

The advantage of the equation 
error method is that it is a very 
simple technique for obtaining esti- 
mates. The technique is applied to 
each equation of motion separately 
which results in a small number of 
unknown parameters. 
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MAXIMUM UKELIHOOD METHOD 


PROCESS 

NOISE,* 


measurement 
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INPUT, u 
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SENSITIVITIES 


PARAMETER 
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Let LIS go on to describe the 
maximum likelihood technique. As 
indicated in this viewgraph, this 
technique assumes again that there 
is an excitation of the system by 
an input and that the system res- 
ponse is measured. Both the input 
variables and the output variables 
are corrupted by the measurement 
noise. In addition the airplane is 
disturbed by external disturbances, 
such as turbulence. Now, the mea- 
surements are used in the Kalman 
filter which has fixed parameters 
and which estimates the response of 
the plant and also gives the sensi- 


tivities for the parameter estima- 
tion. Once the parameters are esti- 
mated, the Kalman filter parameters 
are updated and the whole procedure 
is repeated. Before the procedure 
starts, it is assumed that we know 
the estimates of the parameters. 
After the first iteration, these 
parameters are updated and the pro- 
cedure is repeated. If the assump- 
tion is made that there is no noise 
in the input and that there is no 
process noise, then the maximum 
likelihood method is reduced to the 
so-called output error technique. 



WMtAMEKR CSTIMATION IN FUBXKNCY DOMAIN 



Very often then, when descri- 
bing these methods we are speaking 
in terms of the time domain. It can 
be shown that both techniques can be 
transferred into the frequency do- 
main. The Fourier transform is 
applied both to the model and the 
data. The output of these transfor- 
mations are input to a cost function 
which is formulated in the frequency 


domain. Then the final parameter 
estimates are obtained. 

The frequency domain approach 
can be considered as a complemen- 
tary technique to those in the time 
domain. It can be shown that all 
these techniques, output error, 
maximum likelihood, and equation 
error, can be formulated in the fre- 
quency domain. 
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This viewgraph shows the appli- define a so-called augmented system, 
cation of the extended Kalman filter where the augmented state variable 
to a very simple system. We have a vector includes both the state vari- 
system with only one parameter, and ables and the unknown parameter, 
we want to estimate both the state Then, the Kalman filter is applied 
variables and this parameter at the to this system with the augmented 
same time. The procedure is to state variable. 
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AIRCRAFT EQUATIONS OF NOTION 


a) general equations mith linear aerodynamic functions 
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b) linearized equations 
i • Ax + Bu 

WHERE 

x^ • [au. Am, Aq] or [Av, Ap, Ar] 
- A, or [Aj. A^] 


The second type of method is 
the technique for parameter identi- 
fication of an aircraft with unknown 
structure. So far only the so- 
called step-wise regression tech- 
nique has been applied for this 
purpose. I would like to talk about 
it a little bit more because it is a 
relatively new approach to aircraft 
parameter identification. 

We begin with the aircraft 
equations of motion which are given 
by these two vector equations shown. 
These equations are based upon the 
dynamics of the rigid body. Essen- 
tially they describe the equilibrium 
between the inertia forces, the 
gravity forces, and the aerodynamic 
forces, as well as the equilibrium 
between the inertia moments and the 
aerodynamic moments acting upon the 
airplane. In the previous schemes 


that I have been talking about, 
typically these general equations of 
motion are used. Usually a linear 
-relationship between the forces and 
between the moments is assumed as 
indicated here by this Taylor series 
expansion in which only the linear 
terms are taken into account. A 
second possibility for this is 
simply to linearize the equations 
and thus remove the problems of ex- 
pressions for the aerodynamic forces 
and moments acting on the airplane. 
This set of equations has then a 
very well known form. In this equa- 
tion the state variables are either 
the longitudinal variables (au, aw, 
Aq) or the lateral variables (av, 
AP, Ar), and the control variables 
are the deflections of either the 
elevator or the aileron and rudder. 
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AEROOVNAMIC MOOCL EQUATIONS 
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KMOHI sntunURE — * A UNEAR REGRESSION 

uNKNom snunuRE — > a stepwise regression 

The aerodynamic equation can 
be written in the general form 
shown in this viewgraph where the y 
represents the aerodynamic coeffi- 
cient and 0Q represents the value 
of this coefficient which corres- 
ponds to the trimmed condition. 
The xit X 2 » and so on represent 
the state variables, response vari- 
ables, control variables, or the 
combination of these variables. 
Finally, the 0]^, 02* and so on 

are the unknown parameters. 

When we have a sequence of N 
observations we can substitute the 
measured values into the set of 
regression equations where e repre- 
sents the equation error. Now, 
there are two possible cases. 
I have already talked about the 
first one. We know the structure 
of this linear regression and the 
estimates are simply obtained by 
applying the least squares tech- 
nique. In the second case we do 
not know what the optimal structure 


is, then we have to use the so- 
called stepwise regression. 

Now let me say a few words 
about this technique itself. The 
technique starts with the postula- 
tion of all possible terms which 
might be included in the model. The 
technique selects the optimal subset 
from these by simply checking all 
these postulated terms and selecting 
the one variable which is mostly 
correlated with the dependent vari- 
able, y^. Let us consider that 
this variable is xj. Then the 
parameter 0j is estimated, and the 
model after the first step is simply 
,0g plus Oj^Xj^ . Then the pro- 
cedure continues by checking the re- 
maining terms in the postulated 
model and selecting the most signi- 
ficant one, and by estimating the 
parameter associated with the term 
selected. The technique also re- 
checks whether the terms selected 
before remain significant after 
bringing the new one into the model. 
This is some kind of model building. 
There is a certain criterion which 
tells you where you should stop the 
procedure, and which should result 
in an optimum model. I just includ- 
ed some kind of example that should 
give you the idea how this procedure 
works and what can be achieved by 
applying this procedure. 
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CRITERIA FOR THE SELECTION 
OF A PARSIMONIOUS MODEL 


1. F - STATISTICS THE RATIO (REGRESSION MEAN 

SQUARE) TO (RESIDUAL MEAN SQUARE) 

2. PRESS .-THE PREDICTION SUM OF SQUARES 

3. r2 .-THE SQUARE MULTIPLE CORRELATION COEFFICIENT 

4. ANALYSIS OF RESIDUALS 


What is given here are various 
criteria for the selection of this 
optimal subset from the postulated 
terms in the model for any specific 
aerodynamic coefficient. These 
criteria are called Prediction Sum 
of Squares (PRESS), F-Statistic, and 
squared multiple correlation coeffi- 
cient, (R^). The PRESS tells us 
that its minimum value should give 


us the model with the best predic- 
tion capability. For the F crite- 
rion, the maximum values of the 
F-value should give us the set of 
the minimum number of parameters 
which best fit the model. And 

O 

finally the R^ tells us the per- 
centage of the information explained 
by the model with various terms 
i ncluded. 
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The entry number means the num- 
ber of terms included in the model. 
From what you can see here, the mo- 
del building starts with the first 
step and goes to the fifth one. The 
PRESS criterion was very high. The 
F-criterion was very low. After 
bringing the next terms, as it was 


with the sixth term, there was some 
change in the PRESS criterion and 
sudden improvement in the F-crite- 
rion and also improvement in the 
R term. The model at the seventh 
entry was the best model, or the 
optimum model, whatever you want to 
call it. 


127 




In this example this technique that it is a very poor fit. In this 
was applied to the yawing moment case all the linear terms are inclu- 
coefficient and it shows how the fit ded in the model. This was also re- 
to the data looked after 5 terms are fleeted in the autocorrelation func- 
included in the model. The crosses tion of the residuals which was far 
are the measured data and the thin from the correlation functions for 
line is the prediction of the yawing white noise, which is the assumption 
moment coefficient. You can see of the technique. 
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After bringing in two addi- measured time history based upon the 

tional terms, there was a dramatic estimated aerodynamic model. You 

improvement in the fit of the data can see the difference between the 

and also in the shape of the auto- measured and computed data indicated 

correlation function of the resi- by crosses, 

duals. There is the fit to the 
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HETHODS FOR ON-LINE AIRCRAFT IDENTIFICATION 


a) identification of a system hith given structure 

• weighted least squares 

• HINIMUH VARIANCE 

• EXTENDED KALMAN FILTER - 


SEPARATE PARAMETER AND STATE ESTIMATION 


SIMULTANEOUS PARAMETER AND STATE ESTIMATION 


• IMPULSE RESPONSE ESTIMATION - 


NONPARAMETRIC IDENTIFICATION 


B) identification of a SYSTEM WITH UNKNOWN STRUCTURE 
• LEAST SQUARES LATTICE FILTER 


Now, let us go very briefly to 
the available methods for on-line 
aircraft identification. I would 
like to emphasize from the very be- 
ginning that the group I am working 
with has no experience with this 
type of technique. This summary is 
based more on reading and talking to 
people who are involved in this type 
of experience. It can be seen that 
the on-line methods for identifica- 
tion can be again divided into two 
groups. One is the method for the 
identification of a system with a 
given structure. The other is the 
identification of a system with un- 
known structure. 

130 


In the first case, there has 
been some attempt to develop the 
weighted least squares technique and 
the minimum variance technique which 
give you separate parameter and 
state estimations. We have already 
mentioned the extended Kalman fil- 
ter. When these techniques were ap- 
plied, ignoring their connection 
with the automatic system on board 
the aircraft, it was found that the 
minimum variance and the Kalman 
filter were better than the weighted 
least squares. But when these 
techniques were associated with the 
actual control system, the best 
performance was obtained from the 





simplest technique, which is the 
weighted least squares method. In 
all instances, only the simulation 
data was used. These two techniques 
give separate parameter and state 
estimations, whereas the extended 
Kalman filter gives simultaneous 
parameter and state estimations. 
The fourth technique was applied in 
France by researchers who designed a 
control system where the estimator 
estimates the impulse response 
rather than the parameters of the 
system. So we might talk about a 
technique for the nonparametric 


identification of a system. This 
technique was applied in a simulated 
experiment and not on-line. 

Finally, there is a recent 
technique which could be used on- 
line and which has the capabilities 
at least to estimate, not only the 
parameters, but also the order of 
the system. This technique is based 
upon the so-called least squares 
lattice filter. It is the applica- 
tion of the least squares filter to 
the problem of on-line identifi- 
cation of a system with unknown 
structure. 
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SUMMARY 


• OFF-LINE IDENTIFICATION WELL DEVELOPED AND IMPLEMENTED 

• ON-LINE IDENTIFICATION TESTED IN SMALL NUMBER OF SIMULATED STUDIES 


MAIN PROBLEMS OF ON-LINE IDENTIFICATION: 

1) AIRPLANE PARAMETERS HAVE VARIOUS DEGREES OF SENSITIVITY AND 

VARIABILITY 

2) AIRPLANE CAN CHANGE FLIGHT CONDITIONS WITHOUT SUFFICIENT RESPONSE 

EXCITATION 

3) AIRPLANE WITH SAS HAS DEPENDENT CONTROL INPUTS 


In conclusion, I would like to 
summarize my presentation by stating 
that the off-line identification is 
very well developed and implemented, 
whereas the on-line identification 
has been mostly tested in a small 
number of simulated studies only. 
The main problems we found with the 
on-line identification are the fol- 
lowing. The airplane parameters, in 
general, have various degrees of 
sensitivity and variability, and 
this complicates the problem during 
the estimation off-line because it 


can result in the so-called identi- 
fication problems for various para- 
meters. The airplane can change 
flight conditions without sufficient 
response excitation. Therefore, in 
some instances, we cannot get the 
data used in the identification pro- 
cess, and there is not enough infor- 
mation for obtaining a reasonable 
estimate of the parameters. The 
third problem is that an airplane 
flying with a SAS system has depen- 
dent control inputs, which can again 
lead to identification problems. 
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SELF-REPAIRING DIGITAL FLIGHT CONTROL SYSTEM 


Duane P. Rubertus 
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SELf-REPAIRING FLIGHT CONTROL SYSTEMS 

PAYOFFS 

• 

LONER COST FLIGHT CONTROL SYSTEMS 

• 

RECOVER DAMAGED AIRCRAFT 

• 

AUSTERE SITE OPERATION 

• 

RAPID REPAIRiOURNAROUND 

• 

LAUNCH NITH FAILURES 

• 

FORCE MULTIPLICATION 


The first viewgraph indicates 
the various subject matters that we 
are trying to address. What I want 
to do is give you a little perspec- 
tive of how we in the Air Force look 
at what you have been calling 
restructurable flight controls. We 
do have an ongoing program called 
self-repairing digital flight con- 
trol systems. Some of the things I 
want to bring out are the general 
concept of self-repairing flight 
controls and what it means to the 
Air Force. 

I am sure you have discussed 
many things already, but I will give 
you a little bit of the background 
of what has led up to where we are 
now. We started several years ago 
getting involved with analytic re- 
dundancy and this has got some stu- 
dies into flight test. I know other 
people have been involved with it. 


NASA has the F-8 flying with analy- 
tic redundancy and other people have 
done studies in this area. But the 
results that we have been getting, 
at least on our DIGITAC A7 program, 
have been extremely encouraging to 
us in the sense of being able to 
identify and/or synthesize what we 
would normally sense with other sen- 
sors. And using that to compare 
with other signals, we are able to 
detect, if we only had two sensors, 
which one is good and which one is 
bad, and to continue to operate with 
another level of redundancy in 
there. This is very limited to what 
_we have explored so far but it gives 
us a strong encouragement to proceed 
into something of a larger scale. 

The next area that we have 
looked at has been the area of dis- 
persed/reconf igurable flight con- 
trols. This is a study effort that 
was done for us by Grumman. It in- 
volved two elements: dispersal — 
how far should we disperse the 
elements to survive small arms fire 
up to 37 millimeters; and recon- 
figuration in the face of loss of a 
control surface -- could we use al- 
ternate control surfaces to be able 
to recover the aircraft? And, just 
based upon the studies and simula- 
tions that were done in that pro- 
gram, it looked very encouraging. 
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As a matter of fact, one of the con- 
clusions drawn was that reconfigura- 
tion of control surfaces offers the 
greatest potential for improvement 
of any flight control survivability. 

The next area that we have 
going on now is integrated inertial 
strapdown sensors or multifunction 
sensors, as some people like to call 
it. Work in this area started some 
time ago with studies and we are 
planning to get into flight tests 
later on this year. Basically, this 
is where you use common sensors for 
flight control, navigation, fire 
control, anything that requires 
inertial sensors using skewed sen- 
sors. I know the Navy has sponsored 
a lot of activity in this area. But 
the idea here is to try to pool the 
resources to obtain three-axes atti- 
tude, rate, and acceleration infor- 
mation and have a larger array of 
information available for all these 
elements that I mentioned: flight 
control, fire control, and naviga- 
tion. The thing that we are now 
going into, and plan to flight test, 
is the normalization problem that 
you might have in terms of where you 
locate the sensors. Using two 
packages separated from each other, 
can we get the proper normalization 
of the sensors? The other element 
that we are looking at there is what 


effects structural modes might have 
because of the fact that they are 
located in different areas. Can we 
compensate for these? Can we handle 
the redundancy management of these 
sensors where we have multiple sig- 
nals coming out of one package and 
combine them with something coming 
out of the others? This activity is 
projected to provide quite a payoff 
in terms of cost savings from going 
with this approach. Also the im- 
provements in survivability look 
quite tremendous. 

The next item that affects this 
overall activity is the work going 
jon in microprocessors. The primary 
thrust here is to be able to do more 
processing at lower costs. And the 
concept of parallel processing comes 
into play, of being able to do 
things in parallel as opposed to 
everything being done in serial 
fashion which minicomputers have 
forced us to do. The work going on 
in that area is very encouraging and 
there is quite a bit of activity 
going on. And one of the things we 
want to do is put ourselves in a 
position to capture the technology 
coming out of the activities like 
the VHSIC program. 

The next area that has an 
impact on the overall situation is 
what is going on in the areas of ac- 


tuation. Traditionally, actuators, 
when we start interfacing them with 
fly-by-wire type flight control 
systems, have become quite complex, 
quite costly items that are prone 
to, at least when they use hydraulic 
amplification, problems of contami- 
nation and things of this type which 
cause undefined failures to occur. 
The basic power actuator is quite 
reliable and quite a good design. 
But there are things that we are 
looking at, such as direct drive 
valves, as we have been calling them 
and some people might call them 
other devices, to transfer from the 
hydromechanical type of complexity 
with which we have achieved the re- 
dundancy and the amplification of 
the signal into the electronic area. 

I believe we could be able to handle 
the electronic area with better 
finesse than what we have been able 
to do in the hydraulic actuator sys- 
tem. We have very precise hydraulic 
actuator designs, very fine designs 
from the standpoint that they might 
be considered engineering marvels, 
but they are extremely costly and 
expensive. Other activities going 
on in that area include work going 
on electromechanical actuation and I 
know that nasa Langley has been 
looking at the concept of an all 
electric airplane as well as us and 


the Navy. So there are other areas 
here that offer encouragement for 
improvements in this area of how we 
actually provide the muscle in the 
control system. 

Another thing that we have been 
doing is sponsoring some thesis 
topics for Master students. We kind 
of capture these students for 6 to 9 
months and give them a particular 
problem to work on and, by going 
through a series of these, we are 
able to get quite a free benefit for 
us. And some of the things we have 
been looking at are the robustness 
of new multivariable design tech- 
niques, like being able to handle 
situations such as a loss of a con- 
trol surface or sensors, things of 
this type. We have gotten a little 
bit, not enough, into the aircraft 
modeling itself. What really happens 
when a surface is damaged, lost, or 
is no longer functioning? What hap- 
pens to the aircraft model and all 
the various characteristics in the 
model itself? 

The last item and the one that 
I will be talking more about is the 
self-repairing digital flight con- 
trol system contract which started 
in 1980 and has been going on since. 
It is pretty well wrapped up now in 
terms of the technical effort but 
th.ere are still a few items left. 
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SELF-REPAIRING FLIGHT CONTROL SYSTEM 


A RJ6HT CONTROL SYSTEM THAT CAN 
DETECT. 

ISOLATE, AND 
RECOVER (BY-PASS) FROM 
FAILED OR DAMAGED ELEMENTS 



SKEWED SENSORS DEGRADED CONTROL LEVELS SURFACES 

SYSTEM PARTITIONING 
FAULT BY-PASS 

SELF DETECTION TO LOW COST LRU 


MICRO ELEMENT REPUCATION FOR OR MINIMAL REPUCATION FOR LOW COST 
ZERO UNSCHEDULED MAINTENANCE 


The basic concept probably is 
best described by going on to the 
next viewgraph. What we had laid 
out when we started this program is 
to primarily use the items that are 
healthy in the control system as 
much as we can instead of concen- 
trating on rejecting faults or 
eliminating the bad items in a mass 
of replication of hardware, to get 
around the faults. The idea is to 
try to find better and more novel 
ways to use the healthy items. 


Indicated on this chart, primarily 
in the enclosed areas, are the tra- 
ditional ways in which flight con- 
trols have been dealt with to pro- 
vide the reliability and the fault 
tolerance. The set notes that 
hardware replication or redundancy 
is the primary approach that is 
being used. The things down there 
in the open area in the chart are 
areas that have been looked at in 
the past, probably separately, may- 
be in some combinations. But what 
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we wanted to do in this program was 
to take a system look— to put all 
these things together as much as 
possible, to see how these things 
could be pulled together, and to 
determine what kind of benefits we 
could be achieving if we did this. 
It was kind of a throw out the old 
ways, or not be tied to the old 
ways of doing things and try to 
come up with something new and 
novel. We thought at that time 
that there are probably two areas 
of payoff indicated on the bottom 
there. One is, we could use a 
large replication of microelements, 
microcomputers and things of that 
type to give us a concept of zero 
unscheduled maintenance where you 
would allow faults to accumulate 
and not do anything about them un- 


til the time that you schedule the 
maintenance action and you take 
care of them all. The system would 
have sufficient capability built 
into it to overcome any particular 
problem. Or an alternate way of 
looking at it would be to come up 
with some kind of minimal replica- 
tion. One of the things that con- 
cerned us was the cost of airplanes 
and we needed to find some way of 
getting a very low cost airplane, 
just to match the numbers game that 
we are faced with in a lot of situ- 
ations. Thus, being outnumbered, 
we need to find ways to get in- 
creased numbers and one way of 
doing this is to drive the cost of 
the basic unit down, and so that 
was another kind of basic goal that 
was coming out of this. 
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SOME ABDR INSIGHTS 
BASED ON 
COMBAT DATA 


Then as we got into the program 
there were some other areas investi- 
gated as we can see on to the next 
viewgraph. Aircraft battle damage 
repair (ABDR) was gaining a lot of 
emphasis in the Air Force. And I 
just want to give you some insight 
as to what is going on here. It is 
not only Air Force wide, it is now 
under the auspices of the Joint 
Coordinating Group for Aircraft 
Survivability. They are looking at 
what can be done to give us, not 


only rapid repair, but the techno- 
logy to give us hard, new techniques 
that would give us tolerance to 
-damage as well as rapid repair of 
damage. One of the things that we 
found was that there was very little 
work in that type of program, and 
very little overall activity that 
involved flight controls. And that 
was of some concern to us. We 
talked to the people about this 
and got more involved with this 
activity. 
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Going on to the next viewgraph, 
I will give you a little bit of 
insight into what the situation is. 
The graph shows the status of the 
fleet during a very intense combat 
scenario. During a surge, by day 2 
it is projected that over 60 percent 
of the aircraft would be out of 
action. This is due to the areas 
listed below— attrition, awaiting 


maintenance, or battle damage 
repair. And the basic thought here 
is that you are down to less than 
half your fleet by the second day. 
And it does not get any better after 
that. So there has to be some way 
of turning this around. Again, it 
is a basic problem in just meeting 
the threat that is out there. 
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So, the next viewgraph is kind were as they returned from combat 

of an indication, based upon some situations, primarily in Southeast 

examination that was done, of the Asia. If you look at these you 

areas that have been contributing notice that in the critical areas, 

to the loss of an aircraft during where the control surfaces and the 

combat situations. And flight con- actuators are, there is quite an 

trols account for about roughly 20 absence of holes or hits in those 

percent of the losses based on that areas. The supposition is, I 

analysis that was done. But there guess, or it suggests to us anyway, 
is another negative statistic that that if the aircraft were hit in 

really is hard to quantify in any those areas, that the aircraft did 

sense and that is the number of not return. So it is, as I said, 

aircraft that return and where the not a quantifiable situation, but 

damage occurs. And they have plot- we feel that something has to be 

ted graphs, and I do not have a done to protect the aircraft and to 

graph for it, but they have plotted recover those aircraft so we get 

where the holes in the airplane more back. 
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Going on to the next viewgraph, 
there is another element associated 
with battle damage repair that has 
to do with how many of the various 
systems within the returning air- 
craft are damaged. Of those that 
have damage, some of them only have 
damage in one area, some have multi- 
ple damages, and so forth. But this 
chart is a representative plot of 
the situation. I forget the number 
of situations and the number of air- 
craft that we looked at. Structures 


are the surrounding things and you 
know that they are going to get hit 
just about any time that any sub- 
system is. So that is the reason 
why it has such a high percentage, 
91 percent. Flight controls is only 
shown to be 15 percent in this par- 
ticular chart, but if you take a 
look at what this means as far as 
getting that aircraft turned around 
and back into flying status, now we 
are up to over 40 hours, actually 43 
hours on the median time to repair a 
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flight control system. And it is 
the highest one shown there. So 
even though the number of times that 
a flight control element is damaged 
is low, the time it takes to repair 
it to get it back into service is 
quite high. And it becomes one of 
the primary drivers. If the struc- 
ture is the primary driver, in terms 
of number of times, or total hours 
that are required to repair, the 
flight controls equal pretty much 


what is required for the structure. 
Now, if you get into more massive 
damage by larger elements, missiles, 
etc., the situation changes a little 
bit. The flight controls are still 
quite high. The propulsion goes way 
up primarily because of the damage 
of the various elements in the con- 
trol system, the structure, and the 
surrounding things take quite a 
while to repair. 
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AIRCRAFT BAHLE DAMAGE REPAIR 


TECHNICAL ISSUES 

• ABDR DATA/TECHNOLOGY OPPORTUNITIES 

• DEFERRABILITY/REPAIRABILITY 

I ABDR ASSESSMENT TECHNIQUES 

• ABDR RESOURCE QUANTIFICATION 

• ABDR CRITERIA & DESIGN 

PAYOFF 

• INCREASE COMBAT SORTIE GENERATION BY 35Z 


So as far as the aircraft bat- 
tle damage repair ideas are con- 
cerned, they have listed issues, 
separate from us, that they want to 
address. They want to look at all 
the technical opportunities availa- 
ble here. 

The first choice of what they 
want to build in the future is to 
defer repairability. Defer the 
need to repair items. In other 
words, if you can fly with minor 
damage, etc., go ahead and do so 
and defer repair until a more con- 
venient time, if that ever occurs. 
And if repair is necessary, then do 


it very rapidly so you can get the 
aircraft flying. The primary thrust 
of all of this is to achieve the 
required number of sorties that 

they are going to have to meet, the 
multiple missions per day, etc. 

The need is to have rapid 

assessment techniques of what can 
be repaired and what has to be put 
off, so they can concentrate on 

those things that can be repaired 
in short time. You have to remem- 
ber the austere conditions that 

these crews will be operating in; 
they might have hostile elements 
involved in terms of enemy threats. 
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in terms of chemical and biological 
warfare and the types of suits they 
have to work in. So there are a 
lot of situations that these crews 
are training themselves to work in. 
We need a set of criteria on how to 
handle some of these problems. It 
kind of scares me looking at some of 
the things that they are trying to 
do. Right now, for mechanical link- 
ages, they are putting a wooden 
dowel, or whatever might be avail- 
able in there, as a temporary fix 
and putting bolts through each side 
to repair damaged pushrods, for 
example. There is quite a problem 
with wires and wire bundles in that 
not only do the wires get shattered, 
damaged, etc., but because of the 


situation that they sometimes tend 
to fuse back together. So the mas- 
sive wire bundles is also a problem. 

The tools that they have to 
work with are somewhat limited. 
They do not have all the extensive 
amount of tools available. So, it 

is quite a set of austere conditions 
under which the aircraft are going 
to have to be repaired in battle. 
And they are looking at ways in 

criteria and design, etc., of how to 
do this. 

And the bottom line is, as I 
have said, to get more airplanes out 
there to meet the threat that is 

coming. They have to be able to 

survive and counteract the short war 
situation. 
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SELF-REPAIRING DIGITAL FLIGHT CONTROL SYSTEM 

■iil 

OBJECTIVE 

• Sustain acceptable aircraft 
performance for expanded array 

of battle DAMAGE STATES. 

1 Simplify interface of flight and 
ground crew for fault/damage 

ASSESSMENT AND REPAIR. 

• No UNSCHEDULED MAINTENANCE. 

PAYOFF 

• Increase aircraft availability for 

HISSION. 

• Rapid battle damage repair. 

• Reduce vulnerability to combat 
DAMAGE. 

• Get HOME t QUICK turnaround capability 

• Reduce massive equipment redundancy 
WITH low cost computation ELEMENTS. 

APPROACH 

■ Reconfigure remaining control 
SURFACES TO RECONSTRUCT CONTROL 
moments and FORCES. 

• Automate maintenance diagnostics/ 

REPAIR advisories. 

• Automate pilot assessment for 

REMAINING CAPABILITY AND PROBABILITY 
OF MISSION SUCCESS. 


Going on to this next view- 
graph, I am really getting into the 
self-repairing concept. I have 
tried to give you a little bit of 
the background of some of the things 
that have gone on here. And try to 
get a little bit into the self- 
repairing activity and what is going 
on in this program. And as I have 
indicated, we want to really sustain 
an acceptable aircraft performance 
or provide acceptable flying quali- 
ties for much larger array of bat- 
tle-damaged states. Self repairing 
could also apply to any other trau- 
matic condition that might occur. I 
would like to use an analogy of the 
control system to the human neuro- 
muscular system in terms of the way 


it functions with the sensors and 
the means of transmitting informa- 
tion— the brain doing the computa- 
tion and the muscles being the 
actuators, etc. The human body is 
able, a lot of times, to cope with 
traumatic conditions and to retrain 
itself to do certain things. It 
takes a period of time to do this, 
and that is the kind of thing that I 
would like to think that we are 
trying to train into flight control 
systems. We want them to be able to 
handle, in a very short time, these 
traumatic conditions and still 
satisfy safety of flight conditions. 
At the same time we would also like 
to improve the interface with both 
the flight crew and the ground crew 
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in terms of giving them positive 
assessment or positive alert of what 
is happening as opposed to negative 
type of alerts, and to provide auto- 
matic means by which they can assess 
what the damage is and what they 
have to do to repair it. And then 
the other element, in so far as the 
objective, is to strive for zero un- 
scheduled maintenance, if we can. 

Listed here are the approaches 
that we are using. The basic thing 
is to be able to have sufficient 
smarts in the controls system so we 
can identify when something has gone 
wrong or when a control surface is 
damaged and then be able to reassign 
or reallocate the authority to re- 
construct the forces and moments on 
the aircraft to other control sur- 
faces, at least to a sufficient 
extent. You may have an aircraft 
that, instead of being a 9g air- 
plane, might be a 3g airplane or 
something of that type, but the 
basic thrust is to be able to recon- 
struct sufficient moment and forces 
to control the airplane. We also 
want to do a lot of automation of 
the maintenance diagnostics, repair 
advisories, and provide a capability 
to the pilot so that he knows not 
only that something has gone wrong, 
but it tells him more about what has 
happened, what he might have to do. 


and also what his probabilities 
might be, not only to recover the 
aircraft, but to continue the mis- 
sion. I think that we are moving 
into that stage. It might involve a 
lot of other subsystems in terms of 
gathering sufficient information to 
get into this probability of mission 
success, but I think that it has to 
start some place and that the thrust 
can be driven in that area to 
achieve this capability. 

Listed there in the lower left 
are the kinds of payoffs that we see 
coming out of this. Probably the 
first thing that we want to do is to 
be able to recover an aircraft that 
otherwise might be lost. And then, 
if we can do that satisfactorily, we 
want to consider the possibility of 
being able to continue the mission 
and maybe go to a secondary target 
or do something that might be less 
demanding. Whether the pilot is 
mentally trained to accept those 
kinds of conditions and do that kind 
of thing is another situation that 
has to be addressed, but we want to 
at least provide that type of capa- 
bility for the control system. I 
think that we are going to gain 
quite a force multiplication in 
terms of being able to use aircraft 
more frequently; and once the air- 
craft is launched and committed to a 



mission, we will be able to continue 
the mission and get something accom- 
plished without having to recover 
and essentially lose that whole 
flight, the time, and everything 
else. Several aircraft may turn the 
tides of the battle in this parti- 


cular case. I think also that the 
bottom line is that, if we can rely 
on low cost elements, we can get a 
reduction in the overall redundancy 
level. I will get more into what I 
mean by this a little bit later. 
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SELP-REPAIRINB DFCS 

CONCEPTS 


• 

REC0NFI6URATI0N 

• 

INFLIGHT ALERT 

• 

COMBAT ORIENTED HAINTEHAHCE DIAGNOSTICS 

• 

COST EFFEaiVENESS PHILOSOPHY 


Going on to the next viewgraph, 
the various elements, or concepts 
that we have now in the self- 
repairing control systems are these 
four that are listed there. Three 
of them are technical and the other 
one is a cost item. The first con- 
cept is reconfiguration to continue 
the mission if possible; and if not 
possible, then to recover the air- 
craft when something is damaged, and 
to use the healthy elements to the 
maximum extent possible. We are 
also thinking of using reconfigura- 
tion as a level of redundancy, maybe 
to replace other levels of equipment 
redundancy that we have. For 
example, we would use that recon- 
figuration structure in the same way 
as we would use the last two chan- 
nels of a conventional flight con- 
trol system that we have. By recon- 
figuring, we are able to provide the 
same level of reliability or the 
same level of survivability that we 
would possibly provide with a 


totally quad system, for example. 

Inflight alert, as I mentioned, 
is kind of a negative alert. A 
light comes on and tells the pilot 
that something has happened. But, 
what does he do about it? What does 
this really mean? And while he 
thinks about it something is hap- 
pening. What we need is something 
that is more positive. Two things 
are necessary to automatically take 
care of the situation for the pilot. 
Attempt to keep him positively 
alerted as to the situation. But 
what does this mean to him? What 
does it mean as far as what he is 
going to have to do in the immediate 
future to cope with the situation? 
The control system is now taking 
care of things for him but this is 
going to mean that certain other 
things are going to have to happen 
in the future. As far as what we 
call combat-oriented maintenance 
diagnostics, we are getting into the 
automation of a lot of things that 
are now in the Technical Orders 
(TO's). One of the basic problems 
we have found with a lot of aircraft 
is the skill levels that the people 
assigned to them have and the turn- 
over of people in the maintenance 
areas. There is a lot of time spent 
going and looking up things in the 
TO as to what should be done, what 
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does it mean, and what is the next 
step that they do. And when they 
trace down, sometimes they even run 
into dead ends on the TO's. As a 
result they really do not know what 
to do next. They may go and ask 
somebody else (about the problem) 
and learn that "Oh, I changed the 
actuator here and that solved the 
problem that I had." Such an answer 
may be totally unrelated but it 
sounds similar to their problems and 
so they go ahead and do something 
similar. We have a lot of equipment 
that is floating around back and 
forth in the supply system for which 
there are no failures identified and 
we cannot duplicate them. This is a 
costly process in itself. So we 
want to automate a lot of the things 
that are now in the TO's so that all 
the ground crew has to do is really 
access the control system and it 
simply tells or gives a good indica- 
tion of what has to be done. Proba- 
bly another element of that is to 
isolate down to a line replaceable 
unit so that, it can be replaced and 
very little repair, if any, will be 
done at the flight line unless it is 
damaged where they have to splice 
wires or things of this type. And I 
think a big payoff here, with re- 
spect to the wire bundles, is multi- 
plexing--what it can do and what its 


impact is. Instead of running 
massive bundles of wires around the 
airplane, use a small bundle of 
wires that would be much simpler to 
maintain and to take care of in 
situations such as combat damage. 
Of course, there is a maintenance 
philosophy that operational organi- 
zations would like, and luckily we 
are driving toward it, and that is 
to have two levels of maintenance. 
One is the depot level and the other 
is the flight line level thus 

eliminating the field shop type of 
activity. So I think that this 
automation is driving us into that 
area also. 

As far as the cost effective- 
ness philosophy here, I mentioned 

about using reconfiguration to 
pretty much take over one of the 
levels of redundancy. And, if we 
can do this intelligently, and rely 
on the cost advantage of the lost 
cost items, I think that we now can 
drive the costs down. I will get 

into this in a minute. But, it is 
not only the acquisition costs, but 
the operation and support incurred 
by the operational units that are 
big factors in terms of how and 

what the costs are for these flight 
control systems and the various 
elements in them. 



DATA FLOW 



Going on to the next viewgraph 
I will show you a little bit about 
the data flow that we have in the 
control system. The double-boxed 
areas are the areas that are new. 
Basically, if you look at it, the 
information flows from left to right 
as it normally does in block dia- 
grams. You start out with the sen- 
sors or input signals — the trans- 
ducers coming from the flight deck 
and so forth; and going to the 
bottom line, you end up with outputs 
to the actuator, if nothing is 
wrong. That is pretty much the same 
type of thing that we have had 
before. The control laws are pro- 
cessed much the same way going to 
each surface to do their job as 
required. We are also looking at 


things like extended Kalman filters 
and other items to identify and 
detect system impairments, to be 
able to classify what these are, and 
to feed them to various elements 
within the control system, so that 
we can determine what is wrong, what 
has happened, and know what to do 
about it. Some of the things that 
we are looking at include, not only 
the control surface reconfiguration, 
but what happens up in the sensor 
area also. We would like to be able 
to use more of the information that 
is on board the aircraft, but pro- 
bably reduce the number of sensors 
that are required and dedicated to 
the flight control system, if we 
can, and share more information. So 
we are looking at all three basic 




elements: the sensors, the process- 
ing requirements, and the reconfi- 
guration of the control surface and 
the actuation type devices that are 
required here. 

Now let us concentrate a little 
bit again on the reconfiguration. 
Some situations may occur in which 
the actuator may be locked, or in 
other words, the actuator quit func- 
tioning; it may be damaged, or 
failed in itself, so the control 
surface, in that situation, can 
either be locked and centered or the 
surface may be floating. There may 
be complete separation of the actua- 
tor from the surface and so the sur- 
face winds up floating. Or it may 
be that the bearing point or some- 
thing providing that surface rota- 
tion is jammed, or broken, and the 
surface is floating. Other things 
that can happen are that, due to 
combat damage or some other damage — 
it does not matter, part of the sur- 
face might be missing, or the whole 
thing might be missing, or part of 
the wing or something else might be 
damaged. So we are losing the 
effectiveness of the surface and it 
affects both the controllability and 


the stability. And it affects them 
differently in each situation that 
happens. Thus the idea of some of 
these elements, such as the Kalman 
filter and the impairment detection, 
is to be able to identify what the 
situation is and to supplement some 
particular gains or functions in an 
area here that we call floating sur- 
face deflection. Bring in something 
additional to take care of what has 
happened and to reassign this re- 
configuration process to other 
surfaces. Whether it be flaps, 
spoilers, active flaperons, canards, 
whatever it is, we need a combina- 
tion of surfaces to give us the 
’moments and forces that we need on 
the airplane--to reconstruct them. 
The top block is the automation of 
the knowledge base required to give 
the crew (the flight crew and the 
ground crew) additional information. 
That is kind of the basic way that 
the system flows together. Some of 
the problems that I will get into 
later are: can we do all this iden- 

tification and reconf iguration in 
real time, can we handle the pro- 
cessing load that is required, and 
what does this all mean. 
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SUBSYSTEM COST PROFILE 
BASELINE DIGITAL FLY-BY-WIRE ARCHITECTURE 
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next viewgraph 

shows 

a sub- 


system cost profile as a percentage 
of cost of the total flight control 
system, excluding the power actua- 
tors. This shows how the system 
cost breaks down. It is quite sur- 
prising that, even today, digital 
systems including a lot of the soft- 
ware development costs amortized 
over the total system buy. It comes 
out to where the CPU and memory are 
roughly on the order of 10 to 12 
percent. If these numbers were 
reexamined they would probably have 
to be adjusted a little bit. But 
still, even using today's minicompu- 


ters, this shows that the cost of 
the digital elements are very low. 
And if you look where the big cost 
drivers are, it is in the servo ac- 
tuators, which includes electronics 
for these, and in the inertial sen- 
sors as well as the power supplies, 
etc. But I think that, if we con- 
centrate on driving the costs down 
on the big drivers and accept a cost 
increase in the areas where we are 
already low in cost — and the new 
technology in microprocessors is 
driving the costs down, we could get 
an overall cost reduction in the 
whole flight control system if we 
can make inroads into these big 
'areas. And so to me this is quite 
an eye opener considering that there 
is a tremendous amount of work going 
on in terms of developing micro- 
processor-type architectures and a 
lot of technology in this area where 
the cost is only 10 percent of the 
flight control system cost. Where 
we really could make big gains is if 
we drive the costs down in these 
other areas. And if we keep a sys- 
tem approach, we can probably do a 
lot more than if we just try to come 
up with lower cost elements there. 
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REDUCED PEACETIME OWNERSHIP COSTS 


FEWER UNSCHEDULED 

EXPENSIVE MAINTENANCE 

COMPONENTS PHILOSOPHY 



What this all means, in terms 
of peace time operation as well as 
the readiness of the aircraft for 
battle conditions or any other con- 
ditions, is that we think we can 
get an increase in readiness of the 
aircraft by looking at things like 
self-repairing concepts and the 
various concepts that we have. How 
much increase can be achieved really 
has not been quantified yet, but the 
trend looks very promising in terms 
of getting a tremendous increase in 
readiness when reduced levels of 
resources available to the flight 
control system result, either due to 
internal failures or damage from ex- 
ternal situations. And the overall 


“cost picture, in terms of how we can 
reduce the level of redundancies in 
some areas, leads us to develop more 
smarts into the aircraft and the 
control system, to drive ourselves 
into the new maintenance philoso- 
phies that the Air Force is looking 
at, to reduce or eliminate the field 
level of maintenance, and to get 
more into the unscheduled main- 
tenance philosophy. They have come 
up with a goal of an overall reduc- 
tion of the flight control system of 
30 percent, just for operating it in 
peace time. Normally, the situation 
is such that we would like tremen- 
dous amounts of flexibility and 
capability in there for surviva- 
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bility reasons to have that aircraft 
available to do the job it is inten- 
ded to do. And this has driven us 
into an extremely high cost for 
operating aircraft; but we usually 
operate them, thank God, in peace 


time situations. So, I think we 
can get the best of both worlds by 
looking more at a system approach 
and what some of the new technolo- 
gies can do for us. 
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SELF-REPAIRING FLIGHT CONTROL SYSTEM 


TECHNICAL ISSUES 

I FAULT/DAMAGE IMPAIRMENT PROCESS 
I RECONSTRUCTION OF CONTROL MOHENTS/FORCES 

• IMPAIRED AIRCRAFT MODEL 

I SYSTEM ARCHITECTURE/PROCESSING REQUIREMENTS 
I CREW INTERFACE MODULES 

• SYSTEM READINESS ASSESSMENTS 

• SYSTEM DEMONSTRATION 


The next viewgraph addresses 
some of the technical issues in- 
volved here. I think these are 
some of the major areas of work 
that really need to be done. 
We have laid out the basic concepts 
for this, taking a look at some of 
those things that I think we can 
do. We have done the reconfigura- 
tion in non-real time simulations 
but the fault/damage impairment 
process, combined with the recon- 
struction of the control moments 
and forces, has to be demonstrated 


to show that it can operate in real 
time and that we are not driving 
ourselves into unacceptable burdens 
in terms of computation capability. 
And I think that these are some of 
the technical issues that have to 
be addressed, worked on, and demon- 
strated. It must be shown that 
these concepts can work before any 
of these ideas are going to be ac- 
cepted in a total aircraft system 
sense. 

Another area that I am con- 
cerned about is the models that we 
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use for the aircraft in the im- 
paired state. What is the total 
effect on all these cross-coupling 
terms, that we have driven pretty 
much to zero or into second and 
third order effects, when we have 
impairments in the control sur- 
faces? Are these now going to 
become predominant? I do not think 
that we have really looked at it. 
Neither the models nor the wind tun- 
nel situation really shows us what 
really exists out there as far as 
what the aircraft characteristics 
are. And I think we really need to 
build up a better understanding of 
what has happened to the aircraft 
under these impaired conditions. 
What you try to simulate and dupli- 
cate on a simulator, for example, 
may not be what actually existed in 
that aircraft. I was reading over 
again the two situations attached to 
the workshop invitations and the 
idea that a simulator test shows 
what could have been done by putting 
the pilot, without knowing what is 
going to happen, into that situa- 
tion. I think there is another con- 
dition that probably was not looked 
at, and that is, the extent of the 
effect of the damage on the total 
aircraft stability and control 
characteristics. What you may have 
looked at on the simulator may not 


have really truly represented the 
actual situation. I believe there 
is a lot of work that has to be done 
to improve some of these things. We 
are trying to look at the use of 
some prediction techniques to try to 
generate some of these things. But 
I would really like to have a better 
feeling that the models we are using 
are the correct ones. 

For the system architecture and 
processing requirements, once we 
have identified what the algorithms 
are to do the fault/damage impair- 
ment process, the reconstruction, 
etc., then we have to put it to- 
gether and really look at the pro- 
cessing requirements. How are we 
going to handle this, do it effec- 
tively, do it safely, and satisfy 
all of our reliability and safety 
requirements? 

We have to involve human inter- 
action in terms of the crew inter- 
face modules. But, what really 
makes sense, is to show the pilots 
and the ground crew what really has 
happened and what to do about it. 
Can we automate this procedure? 
What should we really tell them? 
There are some feelings that, as far 
as the pilot is concerned, you just 
automate everything and you do not 
tell them that anything is wrong. 
He will sense that something is 


wrong and his first inclination will 
probably be to go home. But I feel 
strongly that, if we could give them 
the right intelligent information 
and the proper training, eventually 
they will learn to accept that these 
traumatic conditions occur and that 
they may be able to accomplish some- 
thing else while they are there. He 
has already got his life in jeopar- 
dy, as far as being an Air Force 
pilot, so maybe he can go out and 
accomplish a secondary mission. 

As far as system readiness as- 
sessments are concerned, I think we 
just need to do much better than 
what we have done in the past. We 
need to really automate these so 
that we can tell very rapidly 
exactly what has to be done and what 
areas have to be worked on. We do 
not want to require a lot of re- 
peated tests and judgement on the 
part of the ground crew. There is 
still a certain amount of systems 


analysis and assessment work to be 
accomplished that addresses the to- 
tal system. We have looked at the 
individual elements and tried to 
generalize from these to obtain pro- 
jections on the aircraft readiness, 
but all the interface and coupling 
areas have to be addressed as well. 
We need to quantify the actual 
improvements in readiness through 
the application of self-repairing 
concepts. 

Once the elements have been 
developed to include coding and im- 
plementation in real-time proces- 
sing, all the elements have to be 
operated as a system. We need to 
demonstrate that reconf iguration 
can be done in real time without 
severe transients. We also need to 
demonstrate that maintenance tech- 
nicians can readily assess and 
diagnose the flight control system 
fault and damage using the self- 
repairing techniques. 
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SELf-REPAIRING FLIGHT CONTROL SYSTEMS 


PAYOFFS 

• LOWER COST FLIGHT CONTROL SYSTEMS 
I RECOVER DAMAGED AIRCRAFT 

• AUSTERE SITE OPERATION 

• RAPID REPAIRAURNAROUND 

• LAUNCH WITH FAILURES 

• FORCE MULTIPLICATION 


Using self-repairing concepts, 
in particular the reconfiguration 
element, eliminates a layering of 
redundancy. Even though the cost 
of digital logic increases, the 
overall flight control system cost 
is reduced. Reconfiguration will 
permit recovery of some aircraft 
heretofore lost due to traumatic 
conditions such as battle damage or 
massive changes in the flying 
characteristics. Automatic main- 
tenance diagnostics self-contained 
in the aircraft will allow opera- 
tion from austere sites where 
sophisticated ground support equip- 
ment is not available. These diag- 


nostics will assist in turning the 
aircraft around in much shorter 
time, and getting it back into combat. 

Self-repairing systems could 
lead to an appropriate new policy 
of being able to launch with 
failures instead of having to have 
everything full up and operating 
before you launch the aircraft. 
If the failure is in an area that 
we still have sufficient resources 
to cover, then we go ahead and 
launch the aircraft. And through 
all of that we will get a force 
multiplication for the Air Force 
particular needs. 
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ISSUES FOR DISCUSSION 


0 Nonlinear FDI (event detector 

& isolator) 

§ Robust FDI 

0 Coordinate Controller^ Detector^ 
Estimator^ & Isolator 

0 AI/Modern Systems Theory 

0 Sensor Fusion 

0 Man-Machine Interaction 


This is not intended to be an 
all encompassing presentation. 
These are just a few comments that 
were either missed or could be the 


subject of further discussion among 
the people at this workshop. I have 
listed several issues for discussion 
in this viewgraph. 
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I 




NONLINEAR FDI 


(Event Detector & Isolator) 


t Can characterize any detectable event 

MAY MAKE PROBLEM NONLINEAR 
DEPENDING ON HOW THEY ENTER 
SYSTEM (e.G.^ geometry) 


• Solutions: prefilter^ linearize^ 

DIRECT SOLUTION 

six degrees of freedom applied 

TO TARGET MANEUVER PROBLEM. 

HERE WE MUST ESTIMATE DIRECTION^ 
MAGNITUDE^ TIME^ AND TYPE OF 
MANEUVER 


The first issue is that we 
have all talked about the controls 
and how to linearize them and how 
to work with gain schedules and so 
forth. But there are many instan- 
ces where the failure detection and 
isolation scheme is nonlinear too. 
In my opinion, there is just a com- 
plete lack of theory in that area 
and a complete lack of a metho- 
dology to solve the problem. We 
have worked for over a year and a 
half in this area under various 
contracts where we have derived the 
nonlinear GLR equations and came up 


with two or three ways to solve the 
problem. 

We undertook an application 
that is a full blown six degree of 
freedom problem for a missile 
guidance control application. In 
that context, instead of the 
failure detection, the problem 
could be categorized one step 
higher in terms of an event detec- 
tion and isolation scheme with the 
same equation and the same inter- 
pretation. 

In this other application the 
event was a target maneuver which. 




as you can Imagine, quickly becomes 
nonlinear. Just the geometry alone 
makes it nonlinear. Also, clever 
people can characterize many 
different things in this context. 
Any of the unknowns that you do not 
want to put in your model, because 
it would make it higher order or 
whatever, can be lumped into an 
event detection scheme. However, 
now what you have is more events to 
sort out in your algorithm. 
You could be processing events such 
as failures with events such as 
detecting changes in configuration, 
flight conditions, or anomalies, 
this sort of thing. So you could 
actually use one filter to process 
the many various things that are 
going on. 

There are three basic ways in 
which one can approach the problem. 
One way is to do some prefiltering 
since many of these vehicles have 
INS systems and enough instruments 
to preprocess the events in such a 
way that they enter the filter al- 
gorithm in a linearized manner. 
That is one thing that we found to 
have a high payoff. It greatly 
simplifies the problem if it can be 
done at all. Another way is to 
linearize and gain schedule just 
like you do with your control laws. 
And yet another way is to directly 
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solve this problem in real time, 
which is basically just as hard as 
a control problem in real time. 

But you can see that the 
failure detection and estimation 
scheme is complicated enough with- 
out introducing nonlinearities. 
The complications, even in the 
linear case, arise from the fact 
that you have to do identification, 
estimation, and detection all at 
once. You have to separate the on- 
set time of the particular event, 
as well as its magnitude and direc- 
tion, and characterize it, and then 
you have to decide how to isolate 
Jt. So that appears to increase 
the dimension of any filter. You 
can have banks of Kalman filters 
going on right there in two or 
three dimensions. Now, add on top 
of. that the nonlinear problem and 
you have got yourself some real 
problems to solve. It turned out 
that the application that we com- 
pleted, the full-blown six degree 
of freedom, nonlinear scheme, was 
not as horrendous as we thought it 
would be. Once we were able to 
characterize the problem and do 
some scheduling, it turned out to 
be solvable. This was the basic 
worry that we had. We did not know 
whether we could do this because 
the equations, if you take them 




literally, are almost unsol vable. 
There are a lot of state-of-the-art 
techniques that people have used to 
reduce the dimensionality. Examples 
of these techniques are sliding 
windows and the clever charac- 
terization of events to reduce the 
number of events and parameters 
that need to be estimated. 

In this example the geometry 
between the target and the aircraft 
or the missile brought nonlineari- 
ties into the system. And even the 
coordinate system in which you are 


going to write your equations 
becomes very important here. You 
might be clever enough to make a 
linear plant with nonlinear events 
entering your system. That is one 
way to do it. Or you have the 
choice of making a nonlinear plant 
with linear events entering in the 
system, depending on which coordi- 
nate frame you write your equations 
in. Both of these approaches have 
very sound mathematics but very 
different implications in terms of 
the eventual algorithm. 
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ROBUST FDI 


• NASA Lewis Engine FDI Sensitive 

• Can Take SV Approach 

• MIT Theses 


Another issue that I think 
needs to be addressed is robust 
failure detection and isolation 
schemes. There is a lot known 
about robust control systems and a 
lot of work has been done recently. 
Wei 1 , here we have a brand new 
topic to robustify. I know instan- 


ces of failure detection/isolation 
schemes that work great with no 
mismatch conditions. But you mis- 
match them and they just go all to 
pot. A good example of this is the 
NASA Lewis engine failure detection 
and isolation scheme on the Pratt/ 
Whitney F-lOO engine that was 
-recently published. It works well 
under normal conditions. Mismatch 
them at all and nothing works. But 
if you think about the problem, you 
can take the singular value (SV) 
approach and do robust designs of 
your filter. It is not the same as 
the control system problem because 
we are not dealing with a control 
system. But you can think about it 
that way and you can formulate the 
problem in an analogous way and 
come up with an analogous solution. 
In fact, there are two MIT disser- 
tations published on that subject 
to date. Allan Will sky was the 
supervisor on both and he could 
provide this workshop with the mate- 
rial . 
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Coordinate Controller^ Detector^ 
Estimator^ and Isolator 


• Must always work well alone 

• Extreme care and design iteration 

• Control bandwidth dictates design 

MULT I RATE ESTIMATOR^ DETECTOR^ 
AND CORRECTOR 

- Only correct when needed 

- Premise for observers 


Another area that I feel I 
cannot emphasize enough is coordi- 
nated control, detection, estima- 
tion, isolation, and identifica- 
tion. I have found in many appli- 
cations that I have approached that 
people can pretty much get any one 
of them working well independent of 
the other. You know, people design 
good estimators, they have great 


full state feedback, and they have 
detectors based on sensors and 
geometry. They can just pul 1 these 
right out. But you stick them all 
together and I have never seen any- 
thing work the first time. In 
fact, I have also seen people give 
up and say: "it is never going to 
work." The people who finally do 
make it work do it with a lot of 



sweat and iteration. As much as 
the modern control people like to 
think that it is just a cookbook 
procedure, I have never seen any- 
body put this together in cookbook 
fashion at all. The interconnec- 
tion, the interfacing of these 
various techniques is ripe for 
study. I do not think anyone has 
properly addressed it to the point 
where each individual issue has 
been looked at. I can think of 
methodologies and ways to approach 
this that may be systematic. But I 
think we are far from there and 
that this is worthy of research on 
its own. 

I also like Dave Downing's 
comments. I think he hit the nail 
right on the head. If this is an 
optimum control system, the control 
system ought to dictate to the rest 
of the software what it should do. 
For example, the control law band- 
width could pretty much be dictated 
by ultimate performance of the con- 
trol system but when one indepen- 
dently goes and derives an estima- 
tor, filter, detector, whatever, 
they are done for the best detec- 
tion or estimation scheme that they 
can produce. Well, that is just a 
bunch of baloney. They are there 
to support the control system. 
Getting them to work better does 


not mean that the control system is 
going to work better. I feel the 
control system should always have 
the upper hand at dictating that. 
There was another comment made 
about 'correcting only when neces- 
sary.' I think that there is a lot 
of merit in that. That way you can 
get the time requirements of the 
loops to be different. The outer, 
corrective loops should not, per- 
haps, be working as fast as the 
control system loops otherwise you 
have two things adapting to each 
other in the same time scales. 
The system may be able to tolerate 
.some changes up to a threshold and 
then you make some corrections, and 
I think the system might ultimately 
be more stable that way. I also 
feel that there is a premise there 
for the design of observers in the 
first place. Observers do what you 
tell them to do; Kalman filters do 
not always do what you tell them to 
do. One can design an observer in 
a straightforward manner to be com- 
patible with a control scheme and 
philosophy, whereas Kalman filters 
represent a whole new philosophy, a 
whole new scheme. And sometimes, 
in the control context, you cannot 
properly select filter input para- 
meters . 
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AI / Modern Systems Theory 


• Tree Search for Decisions 


• Decision Rules for Q/R Selection 


The fourth issue is the com- 
bination of artificial intelligence 
and modern systems theory. Mike 
Athans mentioned the tree searching 
algorithm for decisions but there 
is also an analogous, dual role in 
which you could use Al rules for 
picking Q and R matrices if you are 
ever thinking of doing that in real 
time. That is no more farfetched 
than tree searches because every 
thing may boil down to tree search- 
ing. The tree search is based on 
what the AI people call decision 


rules. Decision rules are nothing 
more than a smart man in a box. 
He has got a lot of smart things to 
say and, depending on what sequence 
the events occur in real time, he 
stacks these rules together and 
constructs trees. Well, these same 
kind of rules can be used to pick Q 
and R matrices. People have rules 
to do this right now. This sort of 
thing can be used to generate con- 
trol schemes as the need arises in 
a point in time depending on the 
situation. 
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SENSOR FUSION 


• CRLB FOR Geometry and Sensor Selection 
0 May Want Inputs from Pilot 


0 Inputs May Be Hard to Combine Optimally 

- decisions ► ASSESSMENTS 

- SENSORS OF ALL SORTS 

- CAN VARY FROM ANY INSTANT 

(e.g.^ damage^ pilot) 


Another issue is sensor 
fusion. I think we are talking 
about using many different sources 
of information all of which are not 
well formulated in today's fil- 
tering problem. Because you may be 
combining apples and oranges and 
that is sometimes hard to structure 
in an optimal sensor fusion prob- 
lem. 

The first comment I want to 
make in this area is that the 


Cramer-Rao Lower Bound (CRLB) study 
would be of paramount importance 
here for the initial geometry and 
sensor selection because you could 
actually determine the best a sys- 
tem could ever do without having to 
design an algorithm. This saves 
designing algorithms for all the 
systems except for the one you are 
eventually going to use. This also 
gives you a judgment as to how well 
the algorithm you are really going 
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to design works according to the 
best it can do. The CRLB has been 
derived for the nonlinear case by 
Nils Sandell, and published in the 
IEEE Transactions on Automatic Con- 
trol, and it formulates the equa- 
tions for the nonlinear solution to 
the problem. 

If you have inputs from the 
pilot into the system as well as 
from the sensors, it makes it a 
tough fusion problem because inputs 
from the pilot may be assessments 
from decisions he makes according 
to what he thinks the situation is. 
Well, another reason why, if time 
allows it, the pilot can input what 
he thinks is going on is because 
sometimes he is a better adaptive 
control system than the computer 
is. If the time scale is right, he 


has a role, and so, how do you fit 
that in with the outputs of a gyro? 
I think that this is a fundamental 
question that should not be over- 
looked. 

Also, the sensors that your 
are using from time to time may oe 
different. For example, damage may 
be occurring so you might have more 
or less sensors in the system at 
any one time depending on whether 
they are available, or whether they 
are even in the dynamic range and 
so forth. Or the pilot may be en- 
tering information sometimes and 
the time scale may not permit it 
and so the system has to do the 
best it can without it. So try to 
put that into an optimum scheme to 
determine the status of your sys- 
tem. That is nontrivial in itself. 
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MAN-MACHINE INTERACTION 


• Greatest Influence on System 

• Can Adapt If Coordinated Well 

- WHAT SHOULD BE KNOWN 

- WHAT DECISIONS SHOULD BE MADE 

- HOW SHOULD HE INTERACT WITH 
SYSTEM WITH HIS ASSESSMENTS 


The man-machine interaction 
should not be overlooked because 
the greatest influence on the sys- 
tem is that of the pilot. I feel 
that the basic issues are: what 

should the pilot really know, what 
decisions should he be allowed to 
make, and how should he really 
interact with the system and its 
successors? These are fundamental 
questions that should not be over- 
looked as long as the pilot is 


going to be somewhere in the loop. 
And in many cases, like Three-Mile 
Island, there will be disaster once 
in a while when you do not take the 
human into account. It has turned 
out that the Babcock and Wilcox 
people could run that reactor just 
perfectly and never have a problem, 
but you have to design it for the 
persons who will operate it and the 
type of decisions you think they 
are going to make. 
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SUBMARINE CONTROL PHILOSOPHY 


• Ability to recover from failures 

DICTATES WHAT THE CONTROL SYSTEM 
IS ALLOWED TO DO 

t "Any ADDITIONAL CONTROL AUTHORITY 
IS JUST ANOTHER WAY TO GET IT TO 
THE BOTTOM." 


The last issue is just an ob- 
servation that would be interesting 
from the perspective of a submarine 
control system. This is a lot 
different and you have many more 
constraints. In fact, the basic 
difference that I see is that the 
failure modes dictate everything. 
The ability to recover from 
failures dictates what the control 
system is allowed to do. They will 
tell you right off, here is the 
control authority that you have and 
you are not allowed to have any 
more. I do not care if your con- 
trol system is ten times better, 
you are not allowed to do this. An 


example is the limits that are in 
the bow and stern planes. They 
always can go up more than they can 
go down. The limit is set from the 
difference between operating depths 
and crush depths and how long it 
would take them to reverse the 
thrust to stop going down to the 
crush depth based on certain plane 
1 imits. 

Well, although the problems 
are somewhat different, I thought 
that it would be interesting to 
make you aware of a situation in' 
which the failure possibilities 
dictate everything. 





3.0 SUMMARY OF COMMENTS 


At the conclusion of the workshop Mr. William Howell of the Applied 
Controls Branch, NASA LaRC, polled the attendees on their perception of 
the problem. Included herein is a summary of their comments. 

Dr. Michael Athans, MIT . 

• Enough theory is available to attack this problem, but we need to 
understand the robustness of these theories. 

• A theory integration phase to find out the theories that will 
work together, should be an essential part of this program. 

• Early flight simulation and test would be beneficial, but the 
simulation should be stochastic and include structural modes and 
severe wind gusts. Deterministic simulations do not provide a 
true test for the theories that need to be integrated in order to 
tackle this problem. 

Dr. Tom Cunningham, Honeywell, Inc . 

• There are a lot of theoretical techniques available to solve this 
problem. 

• Take the existing theory and technology and extend them to design 
and demonstration of the concept. 

• There should be theoretical work as part of the program, but this 
is not needed as the basis of the program. 

• Early flight demonstration, experimentation, and evaluation is 
absolutely essential and may serve as a pointer and/or driver for 
needed further theoretical development. 

Dr. David Downing, University of Kansas . 

f Carry the flight critical concepts that will emerge from work in 
this area through flight demonstrations or verification. We must 
show that these concepts will work in the real world. 

Mr. Edmund G. Rynaski, Cal span . 

• The major bottleneck problem was recognized by everyone, I be- 
lieve, as being the detection problem. Because we are consider- 
ing a very low probability event, it will be difficult to formu- 
late a detection strategy in which the occurrence of the event 
will happen more often than a false alarm or failure of the 
detection mechanism itself. 
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• Determine the importance of the role of the pilot in the control 
restructuring problem. Depending on the time frame and flight 
condition the pilot may: 

- be in the loop aided by system-derived information 

- be off the loop with the system completely automatic 
(takeoffs and landings). 

• Determine the basic control configuration that would allow 
restructuring to take place. 

• Determine the impact on the basic design of aircraft to be able 
to achieve restructuring most effectively. 

• Flight testing is essential as a precursor to or in parallel with 
the development of supporting theory. 

Dr. V. Klein, George Washington University . 

• On-line system identification should be a part of a restruc- 
turable control system. 

• Theoretical work needs to be done on the robustness of the 
algorithms to modeling errors and, to the effect of the feedback 
environment. 

• All developed techniques must be tested on-line in the real 
world. 

Peter Briggs. General Electric Company . 

• Elements of the current Air Force program on Self-Repairing 
Digital Flight Control Systems will be available for application 
to the next fighter and transport aircraft (early 1990's). 

• In order to make this application realistic advances in two other 
technologies must come to a timely confluence, software tech- 
nology and processor hardware technology. Government should con- 
tinue to stimulate development in these two technologies as well 
as the development of a High Order Programming Language to 
facilitate implementation of complex digital control systems. 

Jarrell Elliott, NASA LaRC . 

• Acceptable configuration of the system after failure affects the 
definition of the problem and the way to deal with it. Restruc- 
turable controls in civilian aircraft is different than in mili- 
tary aircraft. 

• A basic approach to the problem should be the implementation of 
an automatic reaction system (a regulator perhaps) which would 
control the aircraft with the remaining controls and which buys 
time for the pilot to assess the situation and take corrective 
action. 
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• Implement means to automatically assess the situation and display 

information to the pilot which will aid him in taking proper 

actions and avoid improper actions. 

• There is a need to identify some short term goals and some long 

term goals so that areas of the problem can be separated. In the 

process, identify those areas that will require further theoreti- 
cal development. 
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APPENDIX A. DELTA FLIGHT 1080 STORY 
A.l Letter From Captain McMahan 


Captain Jack McMahan of Delta Airlines was invited to attend the work- 
shop. Although he was not able to attend, he sent a letter to the organizer 
summarizing the Delta Flight 1080 incident. This letter is included in 
this appendix. 


September 8, 1982 
2045 Renault Lane 
Atlanta, GA 30345 

Mr. William E. Howell 
NASA 


Dear Mr. Howel 1 , 

I received the information regarding the workshop on Restructurable 
Controls to be held on September 21-22, 1982. As I mentioned in our recent 
telephone conversation, I regretfully will be unable to attend due to a 
prior commitment on these dates. 

Enclosed is the story/history of Flight 1080 as published in the Air- 
line Pilots Magazine, along with a coupl_e of documents I thought might be 
of interest to your group. 

With the left elevator jammed 19* up, I experienced not only a pitch- 
ing moment but also the aircraft had a strong rolling tendency to the 
left--I was up against the control stops in pitch and occasionally in roll 
when attempting a right bank. I also thought of "split spoilers" and under 
the stress of the incident, there was not time to analyze which set of 
spoiler panels to deactivate and I was not sure of our hydraulic system 
integrity--if a mistake was made, there was no published procedure, we 
would have been in worse shape than ever. 

I might add that essentially I flew the aircraft with the 
throttl es--Number #2 advanced to assist pitch and Number #1 following #2 to 
offset roll and followed by Number #3.g^g something like this. 

If I can be of further assistance in this study, please do not hesi- 
tate to call on me. 


Sincerely, 


Jack McMahan 


APPENDIX A 


A. 2* 

Flight 1080 

“As pilot-in-command of Delta Air Lines Flight 
1080, he maneuvered his malfunctioning 
aircraft more than 100 miles through 8,000 
feet of solid overcast to a safe landing. His 
professional judgment and skill merit the 
gratitude of America’s flying public.” 

From Distinguished Service Award presented by the Federal 
Aviation Administration to Capt. Jack McMahan, August 1977 


By Capt. Jack McMahan (DAL) 

On April 12, 1977, I was the captain of 
Delta Flight 1080 which experienced, on 
the San Diego to Los Angeles leg, a 
serious control problem in the pitch 
axis immediately after takeoff. At 
night, overwater and on instruments, 
it appeared to be almost certain 
disaster. 

At departure time, the San Diego 
weather was reported as 800 feet over- 
cast, visibility 5 miles, temperature 
58°F, wind 260° at 8 knots. The L-1011's 
gross weight was 300,000 pounds with 
42,000 pounds of fuel, 41 passengers 
and a crew of 11. The following takeoff 
data was applicable: V, — 123 knots; 
V„— 126 knots; Vr-138 knots; 3.5° 
stabilizer setting; 28% mean 
aerodynamic chord; 1.465 engine 
pressure ratio — alternate thrust. 

The other flight crew members were 
First Officer Will Radford and Second 
Officer Steve Heidt. 

During taxi out. Will performed a 
flight control check of the stabilizer, 
ailerons and spoilers while I made the 
rudder check. The proper control re- 
sponse was verified by the SPI (surface 

AIR LINE PILOT: July 1978 


position indicator) and no abnormal 
control "feel" was experienced. The 
flight controls on the L-1011 are fully 
hydraulic using four separate and 
independent 3,000 P5I (pounds per 
square inch) hydraulic systems. 

The visibility appeared to be dete- 
riorating. I recall thinking that the San 
Diego and Los Angeles weather would 
probably be at or near minimums 
within a couple of hours as the entire 
coastline had a heavy stratus deck 
moving onshore. 

The flight departed San Diego at 
23:53 Pacific standard time, an over- 
water departure to the west on Run- 
way 27. The clearartce was a Scorpion 
Six departure to Los Angeles at an as- 
signed altitude of 10,000 feet. 

During the takeoff roll, quite a bit of 
aircraft vibration was experienced due 
to the roughness of Runway 27. I re- 
laxed forward pressure on the control 
column and reduced the vibration 
somewhat. Acceleration was normal, 
but at Vn of 126 knots, the aircraft 
lifted off with little or no control input 
and a zero stick force. Immediately 
after liftoff an abrupt nose-high excur- 
sion in pitch was experienced that was 


controllable although I did hit the full 
forward limit of the control column 
during this abrupt pitch up. I quickly 
doublechecked the stabilizer setting. It 
was correctly set at 3.5° aircraft nose 
up. Climb attitude of 15° pitch was re- 
established with air speed increasing, 
gear retracted and landing lights 
extinguished. The aircraft appeared to 
return to a normal takeoff flight 
profile. 

Check and doublecheck 

At an altitude of approximately 4(X) 
feet and an air speed of 168 to 170 
knots, the pitch started to become ex- 
cessive, exceeding 15° to 18°. I was 
exerting a light push force on the con- 
trol column and trimming electrically 
by use of thumbwheel trim when the 
thumbwheel movement stopped. The 
pitch controls felt very sluggish and I 
immediately attempted to utilize the 
mechanical trimwheel which serves as 
a back-up system and overides the 
electric trim. There was no response 
with the mechanical trim. I found that 
the trim was already zeroed out with 
full nose-down stabilizer trim as indi- 
cated on the stabiiizer trim indices and 
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zero stabilizer indicated on the SPI in- 
strument. I reset the electric trim 
switches with no effect; the thumb- 
wheel trim remained immovable. 

At this time we went on instruments 
at 800 feet MSL (mean sea level) and I 
started a right turn on course. I re- 
marked to Will that I was having trim 
problems and asked Steve to check 
the hydraulic system. I was not overly 
concerned at this time as the L-1011 
has a fine primary flight control system 
consisting of a flying stabilizer, four 
independent hydraulic systems, a well 
designed light legend to alert the pilot 
of a malfunction and plenty of redun- 
dancy in the system. I was confident 
that one of several possible proce- 
dures would correct our pitch 
problem. 

I unlatched and reset all switches as- 
sociated with trim — pitch trim, mach 
trim and pitch trim monitor — with no 
effect. Will conducted an area test of 
the switchlights to verify light integrity 
as there were no lights illuminated on 
the various panels. Steve double- 
checked hydraulics and checked for 
any opened circuit breakers. By 3,000 
MSL, ali emergency procedures for 


trim, pitch axis jam, flight control path 
jam and hydraulic malfunction were 
exhausted with no effect on control- 
lability. 

San Diego Departure Control was in- 
formed that we were experiencing a 
pitch problem and was asked to stay 
with us. Later we received a handoff 
to Coast Approach. 

The first officer and I both were on 
the controls at this time and exerting 
full forward force on the control col- 
umn. The aircraft continued to pitch 
up and air speed continued to de- 
crease. I recall observing 3,000 feet- 
3,500 feet-4,500 feet on the altimeter. 
Pitch attitude exceeding 18°-20°-22°. Air 
speed decaying: 150-145-143-140. Then 
an air speed of slightly less than the Vi 
speed of 138 knots. We were also ex- 
periencing a roll problem. In attempt- 
ing to maintain a right bank, I hit the 
stops a couple of times in roll control. 

Cao'l 'fl/ 

Suddenly, I had the horrifying reali- 
zation that the loss of the aircraft was 
imminent. (Will and Steve later ex- 
pressed the same opinion.) It ap- 
peared certain that the aircraft would 


enter a stall and, having no control 
over pitch to affect recovery, crash 
Into the ocean. 

It is remarkable how the mind func- 
tions during periods of extreme stress. 
Many thoughts race through your 
mind which can later be recalled with 
amazing clarity. When it became ap- 
parent that we were in deep trouble, 
my first thought was "I have always 
emphasized the mental discipline of 
'fly the aircraft' and I can't even 'fly' 
this one." 

Then, a very unusual experience oc- 
curred. I had a clear mental picture of 
exactly what the aircraft was going to 
do — stall, roll to the left and descend 
vertically disappearing into the 
clouds — at night — over water. The 
sensation was as if I was outside the 
aircraft observing it from some dis- 
tance away. I remember thinking of 
the triumvirate theory: accidents occur 
in series of threes. There was the Ca- 
nary Islands accident involving KLM 
and Pan Am, then the Southern DC-9 
at New Hope, Ga. I thought we were 
about to become the thirdl 

Finally, I recall thinking: "We are 
going to crash into the ocean and no 
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one will over know what hjppcnod. 
Inevitably the conclusion will be pilot 
error. 'Pilot became disoriented while 
executing a night overwater takeoff 
and encountering instrument condi- 
tions.'" I have read this statement a 
number of times as the probabie cause 
of an accident. 

Suddenly I was jolted back to real- 
ity: "Wait just a minute — as many 
night over-water takeoffs and landings 
as I have made! We may iose this air- 
craft, but it won't be because we're 
not hanging in there and it won't be 
because of pilot error." 

At this instant, I felt an intense com- 
passion for my passengers and feliow 
crew members. Their lives, their 
safety, were my responsibility. Perhaps 
this selflessness is the catalyst that 
provides the inner strength or starts 
the adrenaiin pump, permitting one to 
overcome impossibie circumstances. 

"Thrust is affecting pitch. Drag is 
affecting air speed, if I can reduce 
pitch, if I can regain air speed," I 
thought, "we might have a chance to 
recover some degree of controi- 
lability." 

I abruptly reduced thrust on all 
three engines and recognized a 
modest change in controi "feel." I 
then advanced No. 2 throttle full 
forward. Will called my attention to 
the No. 2 engine pressure ratio and I 
recall observing a 1.565 reading. 

Almost simultaneously, I had to in- 
crease thrust on engines 1 and 3 to 
prevent any further loss of air speed. 

I observed pitch correcting back 
through 20° to somewhere around 
18° and the air speed slowly increas- 
ing above 140 knots. I had to further 
increase thrust on the No. 1 engine 
to compensate for a left roll ten- 
dency. I felt certain that we were 
about to recover from a most des- 
perate situation. 

As soon as possible, about 150 
knots, the flaps were retracted from 
10° (takeoff setting) to 4° and the air 
speed started to increase at a better 
rate. Performance data called for 198 
knots (V„ef + 60) before going to the 
clean configuration. 

Moonlight and momentary relief 

Will and I both were still exerting 
full forward pressure on the control 
column and the pitch attitude re- 
mained at 18° to 20° nose high. Steve 
made a full scan of all the circuit 
breakers and switchlight panels in a 
futile attempt to determine the na- 
ture of the malfunction. 
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Radio contact with Coast Approach 
was established and they were in- 
formed (hat we were experiencing 
control problems. They acknowl- 
edged immediately with a proffer of 
assistance and we were cleared direct 
to Seal Beach VOR to maintain 10,000 
feet. I recall methodically returning 
my VOR receiver to 115.7 MH as if we 
had no problems whatsoever, then 
resetting the heading select mode 
and realigning the VOR radial. 

At an altitude of approximately 

9,000 feet, we broke out of the over- 
cast into the clear with quite a bit of 
moonlight — a very welcome change 
from the solid instrument conditions 
we had encountered. I had been hav- 
ing a difficult time just coping with 
the conditions, in addition to at- 
tempting to identify the problem and 
execute emergency procedures. 

At about the same time as reaching 
on top of the clouds, the air speed 
had increased sufficiently and the 
remaining 4° flaps were retracted. 
With an indicated air speed of ap- 
proximately 190 knots, still climbing 
sharply with no control over pitch, it 
became evident that the aircraft 
would climb right on through our as- 
signed altitude of 10,000 feet. Coast 
Approach was advised and they re- 
sponded with a block altitude of 
10,0(X) feet to 12,000 feet. Climbing 
through 11,500 feet with no im- 
provement in our ability to control 
pitch, it was apparent that we could 
not maintain 12,000 feet either. We 
informed Coast Approach and they 
very cooperatively replied, "We have 
you on radar and all altitudes are 
clear. We will stay with you." 

The aircraft continued to climb 
steeply even though Will and I had 
the control column full forward, 
almost touching the instrument 
panel. My mind reeled: "We recov- 
ered from the worst condition when 
it appeared certain that the aircraft 
was going to stall around 5,000 feet, 
now the problem is we can't stop the 
climb and, if I don't do something 
rather quickly, this aircraft is going to 
climb to some unknown altitude, 

25,000 or even 30,000 feet, then run 
out of air speed and controllability 
and descend as steeply as it went 
up." 

Approaching an altitude of 14,000 
feet, I had no alternative except to 
retard the thrust on Engines 1 and 3. 
The aircraft slowly responded with a 
slight pitch change and I attempted 
to descend back to 10,000 feet. I was 


unable to stop the descent rate at 

10,000 feet, but with constant power 
adjustment I was able to regain con- 
trol at 9,500 feet. Then we were back 
up to 10,400 feet, then below 10,000 
feet again and finally fairly well 
stabilized at 10,000 feet. 

The pitch attitude to maintain level 
flight was 12° to 14° with thrust 
equivalent to climb power due to the 
induced drag. The air speed 
stabilized at 195 to 197 knots. The 
throttles were severely staggered to 
maintain control over pitch and a roll 
tendency. No. 2 throttle was well in 
advance of No. 1 and No. 1 in ad- 
vance of No. 3 throttle. The air speed 
had to be controlled below 200 knots 
or the aircraft would again start 
climbing. I was quite concerned 
about the extreme nose high attitude 
of 12° to 14° pitch and the amount of 
thrust required to maintain level 
flight. It appeared that we were work- 
ing within a narrow air speed 
envelope — too fast and control over 
pitch and altitude wa' impossible, 
too slow and a stall would occur. 

Again, all emergency procedures 
were doublechecked in a futile at- 
tempt to identify the nature of the 
problem. There were no known pro- 
cedures relating to the malfunction 
we were experiencing. 

The flight attendants were briefed 
on the situation at this time. We told 
them we had a control problem, but 
that it was now pretty well under 
control and they should not be 
overly concerned about the unusu- 
ally high deck angle. In an attempt to 
improve the center of gravity, we 
asked them to move all the passen- 
gers forward and, as a precaution, to 
position them as near the emergency 
exits as possible. We assured them 
we would keep them fully informed 
of our progress and course of action. 

Now the decision had to be made 
where to go from here. Our position 
was halfway between San Diego and 
Los Angeles. We had our hands full 
with a partially disabled aircraft, 
which we had to attempt to get safely 
on the ground, but where? 

Low ceilings, poor visibility and a 
heavy overcast predominated the 
coastal region, virtually eliminating 
Los Angeles, Long Beach and El Toro 
airports. San Diego was out of the 
question — no way I was going back 
into those conditions. The weather 
was good on the eastern side of the 
mountains and my first choice was 
Paimdale Air Force Plant or Edwards 
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Air Force Base. However, it was now 
well after midnight and I know tliat 
both of these facilities normally close 
down at 10 p.m. and that their con- 
trol towers are not staffed during this 
period. It would take considerable 
time to alert the tower personnel, 
turn the runway lights on and have 
the emergency equipment standing 
by. Time, related to fuel, now be- 
came a critical factor. 

Las Vegas and Phoenix were also 
considered as possible available air- 
ports, but fuel and the high mini- 
mum enroute altitude along these 
routes presented a major problem. 
Altitudes of 11,000 feet to 13,000 feet 
are necessary for terrain clearance in 
these areas, which would require us 
to climb. And there was a strong pos- 
sibility of encountering turbulence 
enroute. With our limited control 
over the aircraft, any encounter with 
turbulence might easily cause us to 
lose control altogether. 

The decision to proceed to Los 
Angeles, even though the weather 
was marginal (700 feet and 4 miles 
visibility) was made primarily due to 
our rather limited options. Most im- 
portantly, we were stabilized in 
smooth air and over water, with 
plenty of altitude to work with in the 
event we had further difficulties, and 
Los Angeles offered our best chance 
for a long, straight-in, stabilized ap- 
proach to Runway 6R. It’s an ap- 
proach I was very familiar with — a 
strong plus factor. 

We contacted Los Angeles Air 
Route Traffic Control, declared an 
emergency, explained our control 
problems and requested a 15 to 18- 
mile straight-in approach to 6R. 

Prepare for the worst 

The flight attendants were briefed 
on the landing plans and instructed 
to prepare for emergency evacuation 
of the passengers. A water ditching 
was a possibility and a land evacua- 
tion a probability. We told them to 
prepare for the worst and hope for 
the best. In a low-key manner an an- 
nouncement was made to the pas- 
sengers that, in accordance with 
company procedures, precautionary 
measures were being taken to insure 
their safety and that we would be 
landing in Los Angeles in a few 
minutes. 

The next question was; "How do 
we land this aircraft? Obviously we 
have very little pitch control, we have 
a roll problem, none of the emer- 


gency or abnormal procedures have 
boon effective. Why isn't the 
stabilizer more effective? The huge 
flying tail of the L-1011 has a tremen- 
dous amount of authority in pitch; 
the aircraft is trimmed full nose 
down — ^why no response? Do we 
have a spoiler problem causing the 
roll? Is the problem hydraulic?" 

We had a confounding number of 
unanswered questions. 

I thought a normal landing utilizing 
33° flaps and an air speed pad of per- 
haps 10 to 12 knots would not be fea- 
sible for a number of reasons. I was 
afraid that on landing, with no con- 
trol over pitch, when the aircraft en- 
tered ground effect I would not be 
able to force it on the runway and we 
might float all the way across the air- 
port. Or worse, when we set up the 
landing flare the aircraft might pitch 
up to an altitude of 200 or 300 feet, 
stall and crash. And we would be 
helpless to prevent it. 

Another consideration was the 
thrust/drag curve during the ap- 
proach. If we got behind the power 
curve, would there be enough thrust 
to overcome drag and still be able to 
control the aircraft? My evaluation 
was that there was a strong possibil- 
ity we might reach an altitude of 
400 or 500 feet during the approach 
and lose control. This reasoning was 
also a major consideration in select- 
ing the west to east approach to 
Runway 6R at Los Angeles. We 
elected to remain over water to avoid 
endangering lives and property on 
the ground. Although landing east to 
west on Runway 24 is a better ap- 
proach, it is over residential areas. I 
had a mental picture of what a 
holocaust this could create. I thought 
to myself, if we lose it, we lose it over 
water. 

I decided that we would try one 
Step at a time, using incremental 
flaps, verifying pitch control with 
each increment and attempting to es- 
tablish a configuration' of 22° flaps 
and an air speed of 165 knots for the 
approach and landing. At 4° flaps the 
aircraft pitched down slightly and I 
was able to recover about one-half 
inch of control column movement 
from the full forward limit. At 10° 
flaps the additional pitch-down gave 
me another half inch of control re- 
sponse. The aircraft was stabilized at 
180 knots, 10° flaps, 12° pitch, and 
ohe inch of control movement was 
available. Even though we were still 
‘everely limited, this felt like a major 


accomplishment. 

I tried the autopilot to determine if 
it had some trim authority we might 
Utilize. The aircraft pitched up im- 
mediately and the autopilot was dis- 
engaged. 

While maintaining 180 knots air 
speed and the 10° flap configuration, 
we were able to maneuver the air- 
craft reasonably vvell and follow radar 
vectors to position for a 6R instru- 
ment approach. 

Instrument conditions were again 
encountered at approximately 9,000 
feet during descent. We continued to 
5,000 feet and intercepted 6R runway 
instrument localizer and glide slope 
15 miles from the runway threshold. 
The approach was made with 10° 
flaps and 160 knots indicated air 
speed with a sink rate of 800 feet to 
900 feet per minute. The pitch at- 
titude was 10° to 12° nose up, and I 
recall thinking that we might experi- 
ence a tail strike at touchdown. 
Autoground spoilers were disarmed 
to prevent any additional pitch-up 
tendency on landing. 

Steve informed the flight at- 
tendants that we would be on the 
ground shortly and to be prepared 
for a possible emergency evacuation 
on our signal. Steve also made a 
reassuring announcement to the 
passengers. 

We had it made — almost 

The instrument approach was ini- 
tiated and going very well. I was able 
to maintain the target air speed of 
180 knots and control the sink rate to 
remain on glide slope with the lim- 
ited pitch control and varying thrust. 
The approach checklist was com- 
pleted and for the first time since 
departing San Diego I felt we more 
or less "had it made." All we had to 
do was extend the landing gear, 
make a flap change to 22°, break out, 
establish visual contact with the run- 
way and land the aircraft. 

Then, at 2,500 feet, when the land- 
ing gear was extended, the aircraft 
again pitched up. I shoved the con- 
trol column full forward but the air- 
craft continued to climb while the air 
speed deteriorated, and we were 
going above the glide slope. 

My first thought was: "Since we 
can’t control the aircraft with the 
gear down, retract the gear, turn to a 
south heading and ditch in the ocean 
parallel to the coastline." 

I felt that it would be impossible to 
control a missed approach or a go- 
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around and that this was a "one 
shot" attempt. We were so close and 
yet so far; again in serious difficulty 
and on the verge of.disaslcr. 

Once more I increased thrust on 
No. 2 engine, reduced thrust on en- 
gines 1 and 3. The aircraft responded 
slowly and I was able to maneuver 
back down to reestablish glide slope 
tracking. The flying was a little rough 
in this area, a major power change 
was required to stop the climb and 
get a descent restarted and to at- 
tempt to capture glide slope. I left 
the landing gear extended, selected 
18° flaps, and the air speed stabilized 
at 170 knots. 

Upon reaching 700 feet, we broke 
out of the overcast and visual contact 
with the runway was established. We 
were aligned with the runway and 
had a sink rate of 800 to 900 feet per 


minute, which was going to be per- 
fect for my touchdown reference 
point. I was not going to attempt a 
flare — just fly the aircraft to 
touchdown. I abandoned the 
thought of using 22° flaps, things 
were going so well, I thought, "Don't 
change a thing — ^just get it on the 
ground!" 

Touchdown was made at approxi- 
mately 165 to 170 knots indicated air 
speed in the first 1,000 feet of Run- 
way 6R. After main gear contact, the 
nose did not come down, and I could 
not force the nose over with the con- 
trol column full forward. It was nec- 
essary to apply main-wheel braking 
in order to force the nose wheel 
down. 

After 55 minutes of airborne time, 
we were on the ground. 

I applied reverse thrust on engines 


1 and 3 and reverse idle on No. 2, 
since heavy reverse thrust on the 
No. 2 engine tends to pitch the nose 
up. I'd had enough pitch-ups for one 
day. 

No tail strikes. No blown tires. We 
exited the runway at taxiway No. 47 
and taxied to the ramp. 

The malfunction was determined 
to be the left elevator jammed in the 
"up" position. Presumably the left 
elevator aft drive quadrant (Bell 
crank) and drive cable failed during 
the flight control check prior to 
takeoff. There is no cockpit indica- 
tion for this type of failure on the 
L-1011. 

An equipment substitution was 
provided, and the crew and passen- 
gers continued Flight 1080 without 
further incident. □ 
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APPENDIX B. AMERICAN AIRLINES DC-10 CRASH IN CHICAGO 


This appendix presents excerpts from the National Transportation 
Safety Board Accident Report on the American Airlines DC-10 crash at 
Chicago-O'Hare International Airport on May 25, 1979 (NTSB-AAR-79-17, Dec. 21, 1979). 


pp 25-54; 


Each of the thirteen pilots who participated in the simulation was 
thoroughly briefed on the flight profile of Flight 191. In the simulator the No. 1 
engine and pylon assembly was programmed to separate at 10** of rotation on all 
takeoffs with simultaneous loss of the No. 1 hydraulic system. On some test runs 
the No. 3 hydraulic system was also programmed to fail. Generally, slats began to 
retract about 1 sec after the engine and pylon separated and were fully closed in 
about 2 sec. Some test runs were conducted with the slat retraction beginning 10 
to 20 sec after the engine and pylon separated. Speed control guidance from the 
flight director was available for all runs, and the stickshaker, programmed for the 
slat-retracted-airspeed schedule, was operational on some runs. 

During the tests, about 70 takeoffs and 2 simulated landings were 
conducted. In all cases where the pilots duplicated the control inputs and pitch 
attitudes shown on the Flight 191*s DFDR, control of the aircraft was lost and 
Flight 191’s flight profile was duplicated. Those pilots who attempted to track the 
flight director's pitch command bars also duplicated Flight 191's DFDR profile. 


In many cases, the pilots, upon recognizing the start of the roll at a 
constant pitch attitude, lowered the nose, increased airspeed, recovered, and 
continued flight. The roll angles were less than 30% and about 80 percent right 
rudder and 70 percent right-wing-down aileron were required for recovery. In 
those cases where the pilot attempted to regain the 14® pitch attitude commanded 
by the flight director command bars, the aircraft reentered the left roll. 
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pp 


The simulator tests showed that the aircraft could have been flown 
successfully at speeds above 159 KIAS, or if the roll onset was recognized as a 
stall, the nose could have been lowered, and the aircraft accelerated out of the 
stall regime. However, the stall warning system, which provided a warning based 
on the 159 KIAS stall speed, was functioning on the successful simulator flights. 
Although several pilots were able to recover control of the aircraft after the roll 
began, these pilots were all aware of the circumstances of the accident. All 
participating pilots agreed that based upon the accident circumstances and the lack 
of available warning systems, it was not reasonable to expect the pilots of Flight 
191 either to have recognized the beginning of the roll as a stall or to recover from 
the roll. The Safety Board concurs. 

In addition, the simulator tests showed that the aircraft could have 
been landed safely in its accident configuraition using then current American 
Airlines procedures. The simulator tests also disclosed that the aircraft could have 
been landed with an asymmetric leading edge slat configuration. The speed 
margins during the final positions of the landing approach are also very smaUj 
however, the landing situation is considered less critical since additional thrust is 
readily available as required to either adjust the flightpath or accelerate the 
aircraft. In addition, service experience has shown that loss of slats on one wing 
during the approach presents no significant control problems. 


In summary, the loss of control of the aircraft was caused by the 
combination of three events; the. retraction of the left wing’s outboard leading 
edge slatsj the loss of the slat disagreement warning system; and the loss of the 
stall warning system — all resulting from the separation of the engine pylon 
assembly. Each by itself would not have caused a qualified flightcrew to lose 
control of its aircraft, but together during a. critical portion of flight, they created 
a situation which afforded the flightcrew an inadequate opportunity to recognize 
and prevent the ensuing stall of the aircraft. 


*U.S GOVERNMENT PRINTING OFFlCE:1983 -6 39 -008/ 25 


188 


2. Govtrnmant Accatsion No. . 


3. Racipiant's Catalog No. 


1. Raport No. 

NASA CP-2277 


4. Title and Subtitle 

RESTRUCTURABLE CONTROLS 

5. Raport Date 

August 1983 

6. Performing Organization Code 

505-34-13-10 

7. Author(s) 

R. J. Montoya, W. E. Howell, W. T. Bundick, A. J. Ostroff, 
R. M. Hueschen, and Christine M. Belcastro, Compilers 

8. Performirtg Organization Report No. 

L-15638 

10. Work Unit No. 

9. Performing Organization Name and Address 


NASA Langley Research Center 
Hampton, Virginia 23665 

11. Contract or Grant No. 


13. Type of Report and Period Covered 

12. Sponsoring Agency Name and Address 

Conference Publication 

National Aeronautics and Space Administration 
Washington, DC 20546 

14. Sponsoring Agency Code 

.J 

15. Supplementary Notes 

R.J. Montoya: Research Triangle Institute, Research Triangle Park, North Carolina. 

W.E. Howell, W.T. Bundick, A.J. Ostroff, R.M. Hueschen, Christine M. Belcastro: 
NASA Langley Research Center, Hampton, Virginia. 


16. Abstract 


Future aircraft with highly sophisticated controls are likely to have multiple 
interdependent failure modes which will be more difficult for the pilot to recognize. 
Such failure modes are more likely to lead to unanticipated sequences of events for 
which the solution is not intuitively clear to the pilot. Furthermore, it may be 
impossible to recognize all of these modes during the design. 

These proceedings document the Workshop on Restructurable Controls held at NASA 
Langley Research Center, September 21-22, 1982. The workshop examined the possibil- 
ities of combining various advanced technologies to provide on-line assistance to 
pilots dependent on flight-crucial controls when anticipated or unanticipated failures 
occur. In the first case, it may be beneficial to reconfigure the aircraft controls 
with previously stored alternatives, and in the second case it may be possible to 
restructure the controls using a combination of technologies. Applicable technologies 
include failure detection and isolation methods, parameter identification techniques, 
and modern control theory. Significant effort is required to integrate these into a 
plausible approach. 


17. Key Words (Suggested by Author(s)) 

Controls Reconfigurable controls 

Guidance Restructurable controls 

Failure detection 
Parameter identification 
Control theory 


18. Distribution Statement 

Unclassified - Unlimited 


19. Security Classif. (of this report) 

20. Security Classif. (of this page) 

21. No. of Pages 

22. Price 

Unci assi fied 

Unclassified 

195 

A09 


:^ubject category 08 


N-305 


For sale by the National Technical Information Service, Springfield, Virginia 22161 

















